ZAP Scanning Report

SQL injection may be possible.

Do not trust client side input, even if there is client side validation in place.

In general, type check all data on the server side.

If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'

If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.

If database Stored Procedures can be used, use them.

Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!

Do not create dynamic SQL queries using simple string concatenation.

Escape all data received from the client.

Apply a 'whitelist' of allowed characters, or a 'blacklist' of disallowed characters in user input.

Apply the principle of least privilege by using the least privileged database user possible.

In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.

Grant the minimum database access that is necessary for the application.

The page results were successfully manipulated using the boolean conditions [query' AND '1'='1' -- ] and [query' OR '1'='1' -- ]

The parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison

Data was NOT returned for the original parameter.

The vulnerability was detected by successfully retrieving more data than originally returned, by manipulating the parameter

https://www.owasp.org/index.php/Top_10_2010-A1

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

A SQL injection may be possible using the attached payload

Do not trust client side input, even if there is client side validation in place.

In general, type check all data on the server side.

If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'

If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.

If database Stored Procedures can be used, use them.

Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!

Do not create dynamic SQL queries using simple string concatenation.

Escape all data received from the client.

Apply a 'whitelist' of allowed characters, or a 'blacklist' of disallowed characters in user input.

Apply the privilege of least privilege by using the least privileged database user possible.

In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.

Grant the minimum database access that is necessary for the application.

The page results were successfully manipulated using the boolean conditions [http://www.tevelcyber.com/robots.txt AND 8436=8436-- PieL] and [http://www.tevelcyber.com/robots.txt AND 9298=5633-- xnQa]

The parameter value being modified was stripped from the HTML output for the purposes of the comparison.

Data was returned for the original parameter.

The vulnerability was detected by successfully restricting the data originally returned, by manipulating the parameter.

https://www.owasp.org/index.php/Top_10_2010-A1

https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

A backup of the file was disclosed by the web server

Do not edit files in-situ on the web server, and ensure that un-necessary files (including hidden files) are removed from the web server.

http://www.tevelcyber.com/wp-admin

http://projects.webappsec.org/Predictable-Resource-Location

http://cwe.mitre.org/data/definitions/425.html

A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.

Ensure that the HttpOnly flag is set for all cookies.

http://www.owasp.org/index.php/HttpOnly

A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.

http://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)

The page includes one or more script files from a third-party domain.

Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.

A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.

Ensure that the HttpOnly flag is set for all cookies.

http://www.owasp.org/index.php/HttpOnly