vendor:
K-Links Directory
by:
Corwin
7.5
CVSS
HIGH
SQL-INJECTION, XSS
89, 79
CWE
Product Name: K-Links Directory
Affected Version From: All
Affected Version To: All
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
K-Links Directory SQL-INJECTION, XSS
K-Links Directory is vulnerable to SQL-INJECTION and XSS. An attacker can exploit the vulnerability by sending a malicious SQL query to the vulnerable parameter in the report, visit, addreview and refer page. An attacker can also exploit the XSS vulnerability by sending a malicious script to the login_message parameter in the index page.
Mitigation:
Input validation should be done to prevent SQL-INJECTION and XSS attacks. The application should also be tested for any other security vulnerabilities.
