Burp Scanner Sample Report
Summary: PortSwigger's sample Burp Scanner report on ginandjuice.shop lists 17 issue types, including SQL injection at three points (the category parameter, a request body, and a session cookie), XML external entity injection, and reflected cross-site scripting across four search and product-search URLs. The report also flags client-side template injection, DOM-based open redirection, client-side prototype pollution, external service interaction over HTTP and DNS via the Referer header, a vulnerable JavaScript dependency, and missing Strict Transport Security, secure cookie, and HttpOnly flags.
Key Takeaway: The same Referer header drives four HTTP and four DNS external service interaction findings, meaning the application can be induced to send requests to systems it can reach, including internal services not otherwise exposed to outside attackers. SQL injection alone is noted as sufficient to read or modify critical application data, escalate database privileges, and take control of the database server.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026