Paros Scanning Report

Report generated at Thu, 31 May 2007 12:00:00.

Summary of Alerts

Risk LevelNumber of Alerts
High2
Medium4
Low1
Informational0

Alert Detail

High (Suspicious)SQL Injection Fingerprinting

Description

SQL injection may be possible.

URL
http://192.168.230.66/cdt/index.php
Parameter
Submit3=Valider&classe_ID=2%27INJECTED_PARAM
Other information
SQL

Solution

Do not trust client side input even if there is client side validation. In general,

  • If the input string is numeric, type check it.
  • If the application used JDBC, use PreparedStatement or CallableStatement with parameters passed by '?'
  • If the application used ASP, use ADO Command Objects with strong type checking and parameterized query.
  • If stored procedure or bind variables can be used, use it for parameter passing into query. Do not just concatenate string into query in the stored procedure!
  • Do not create dynamic SQL query by simple string concatentation.
  • Use minimum database user privilege for the application. This does not eliminate SQL injection but minimize its damage. Eg if the application require reading one table only, grant such access to the application. Avoid using 'sa' or 'db-owner'.

Reference

  • The OWASP guide at http://www.owasp.org/documentation/guide
  • http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
  • http://www.spidynamics.com/whitepapers/WhitepaperSQLInjection.pdf
  • For Oracle database, refer to http://www.integrigy.com/info/IntegrigyIntrotoSQLInjectionAttacks.pdf

High (Suspicious)SQL Injection

Description

SQL injection is possible. User parameters submitted will be formulated into a SQL query for database processing. If the query is built by simple 'string concatenation', it is possible to modify the meaning of the query by carefully crafting the parameters. Depending on the access right and type of database used, tampered query can be used to retrieve sensitive information from the database or execute arbitrary code. MS SQL and PostGreSQL, which supports multiple statements, may be exploited if the database access right is more powerful.

This can occur in URL query strings, POST paramters or even cookies. Currently check on cookie is not supported by Paros. You should check SQL injection manually as well as some blind SQL injection areas cannot be discovered by this check.

URL
http://192.168.230.66/envole/custom/rss2html.php?rss_url=http://wwwphp.ac-orleans-tours.fr/clg-louis-bleriot-toury/backend.php3/');waitfor%20delay%20'0:0:15';--
Parameter
rss_url=http://wwwphp.ac-orleans-tours.fr/clg-louis-bleriot-toury/backend.php3/');waitfor delay '0:0:15';--
URL
http://192.168.230.66/cdt/index.php
Parameter
Submit3=Valider&classe_ID=2%27INJECTED_PARAM
Other information
SQL

Solution

Do not trust client side input even if there is client side validation. In general,

  • If the input string is numeric, type check it.
  • If the application used JDBC, use PreparedStatement or CallableStatement with parameters passed by '?'
  • If the application used ASP, use ADO Command Objects with strong type checking and parameterized query.
  • If stored procedure or bind variables can be used, use it for parameter passing into query. Do not just concatenate string into query in the stored procedure!
  • Do not create dynamic SQL query by simple string concatentation.
  • Use minimum database user privilege for the application. This does not eliminate SQL injection but minimize its damage. Eg if the application require reading one table only, grant such access to the application. Avoid using 'sa' or 'db-owner'.

Reference

  • The OWASP guide at http://www.owasp.org/documentation/guide
  • http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
  • http://www.spidynamics.com/whitepapers/WhitepaperSQLInjection.pdf
  • For Oracle database, refer to http://www.integrigy.com/info/IntegrigyIntrotoSQLInjectionAttacks.pdf

Medium (Warning)Password Autocomplete in browser

Description

AUTOCOMPLETE attribute is not disabled in HTML FORM/INPUT element containing password type input. Passwords may be stored in browsers and retrieved.

URL
http://192.168.230.66/horde/imp/redirect.php?Horde=00ad31d46a52f168f029eb3fe993fdf6
Other information
<input type="password" tabindex="2" name="pass" />
URL
http://192.168.230.66/cdt/enseignant/index.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/index.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/type_activite_ajout.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/type_activite_ajout.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/semaine_ab_voir.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/semaine_ab_voir.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/passe_modif.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/passe_modif.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/index.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/liste_documents.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/liste_documents.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/index.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/imprimer_menu.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/imprimer_menu.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/gestion_sem_ab.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/gestion_sem_ab.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/enseignant/emploi.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/enseignant/emploi.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/authentification/auth.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/authentification/auth.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/index.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/index.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt/index.php
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt/index.php
Other information
<input name="passe_c" type="password" id="passe_c" />
URL
http://192.168.230.66/cdt
Other information
<input name="passe" type="password" id="passe" />
URL
http://192.168.230.66/cdt
Other information
<input name="passe_c" type="password" id="passe_c" />

Solution

Turn off AUTOCOMPLETE attribute in form or individual input elements containing password by using AUTOCOMPLETE='OFF'

Reference

http://msdn.microsoft.com/library/default.asp?url=/workshop/author/forms/autocomplete_ovr.asp

Medium (Suspicious)Lotus Domino default files

Description

Lotus Domino default files found.

URL
http://192.168.230.66/?OpenServer
URL
http://192.168.230.66/?Open

Solution

Remove default files.

Reference

Medium (Suspicious)Cross site scripting

Description

Cross-site scripting or HTML injection is possible. Malicious script may be injected into the browser which appeared to be genuine content from the original site. These scripts can be used to execute arbitrary code or steal customer sensitive information such as user password or cookies.

Very often this is in the form of a hyperlink with the injected script embeded in the query strings. However, XSS is possible via FORM POST data, cookies, user data sent from another user or shared data retrieved from database.

Currently this check does not verify XSS from cookie or database. They should be checked manually if the application retrieve database records from another user's input.

URL
http://192.168.230.66/envole/ajaxp_backend.php
Parameter
rs=<SCRIPT>alert(Paros);</SCRIPT>
URL
http://192.168.230.66/cdt/index.php
Parameter
classe_ID=<SCRIPT>alert(Paros);</SCRIPT>

Solution

Do not trust client side input even if there is client side validation. Sanitize potentially danger characters in the server side. Very often filtering the <, >, " characters prevented injected script to be executed in most cases. However, sometimes other danger meta-characters such as ' , (, ), /, &, ; etc are also needed.

In addition (or if these characters are needed), HTML encode meta-characters in the response. For example, encode < as &lt;

Reference

  • The OWASP guide at http://www.owasp.org/documentation/guide
  • http://www.technicalinfo.net/papers/CSS.html
  • http://www.cgisecurity.org/articles/xss-faq.shtml
  • http://www.cert.org/tech_tips/malicious_code_FAQ.html
  • http://sandsprite.com/Sleuth/papers/RealWorld_XSS_1.html

Medium (Suspicious)Cross site scripting without brackets

Description

Cross-site scripting or HTML injection is possible without '<' and '>'. Malicious script may be injected into the browser which appeared to be genuine content from the original site. These scripts can be used to execute arbitrary code or steal customer sensitive information such as user password or cookies.

Very often this is in the form of a hyperlink with the injected script embeded in the query strings. However, XSS is possible via FORM POST data, cookies, user data sent from another user or shared data retrieved from database.

Currently this check does not verify XSS from cookie or database. They should be checked manually if the application retrieve database records from another user's input.

URL
http://192.168.230.66/horde/imp/redirect.php?Horde=00ad31d46a52f168f029eb3fe993fdf6
Parameter
new_lang=paros" style="background:url(javascript:alert('Paros'))

Solution

Do not trust client side input even if there is client side validation. Sanitize potentially danger characters in the server side. Very often filtering the <, >, " characters prevented injected script to be executed in most cases. However, sometimes other danger meta-characters such as ' , (, ), /, &, ; etc are also needed.

In addition (or if these characters are needed), HTML encode meta-characters in the response. For example, encode < as &lt;

Reference

  • The OWASP guide at http://www.owasp.org/documentation/guide
  • http://www.technicalinfo.net/papers/CSS.html
  • http://www.cgisecurity.org/articles/xss-faq.shtml
  • http://www.cert.org/tech_tips/malicious_code_FAQ.html
  • http://sandsprite.com/Sleuth/papers/RealWorld_XSS_1.html

Low (Warning)Private IP disclosure

Description

Private IP such as 10.x.x.x, 172.x.x.x, 192.168.x.x is found in the HTTP response body. This can be used in exploits on internal system.

URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/ajaxp_feed.php
Other information
192.168.230.66
URL
http://192.168.230.66/envole/?et=&pid=&pnlo=1
Other information
192.168.230.66
URL
http://192.168.230.66/envole/
Other information
192.168.230.66

Solution

Remove the private IP address from the HTTP response body. For comments, use jsp/asp comment instead of HTML/javascript comment which can be seen by client browsers.

Reference