vendor:
K-Search
by:
Sangteamtham
8,8
CVSS
HIGH
SQL Injection and XSS
89, 79
CWE
Product Name: K-Search
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
K-Search (SQL/XSS) Multiple Remote Vulnerabilities
K-Search provides a way to start a meta-search engine and earn money by displaying relevant sponsored results taken from Pay Per Click feeds or own sponsors. An attacker can exploit the SQL Injection vulnerability by sending a crafted request to the application with a malicious SQL query. An attacker can exploit the XSS vulnerability by sending a crafted request to the application with a malicious JavaScript code.
Mitigation:
Input validation should be performed to prevent SQL Injection and XSS attacks. Sanitize user input and encode output to prevent XSS attacks.
