Quantcast
WebProNews Ad Rates Click Now!
Read WebProNews
With Friends!

Google API Vulnerable To Cross-Site Scripting

By · November 29, 2005 · Leave a Comment
Get the WebProNews Newsletter:

Security advisory firm Secunia reported a cross-site scripting vulnerability in the Google API Search Engine Script version 1.x, and confirmed it does exist in 1.3.1.

Secunia referenced a vulnerability report on the Unsecured Systems blog describing the flaw, which had not been patched at press time.

The blog described the vulnerability, which Secunia tested and found it does exist:

Input passed to the “REQ” parameter in “index.php” when performing a search isn’t properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

example:
/index.php?REQ=%3Cscript%3Ealert(‘r0t%20XSS’)%3C/script%3ESubmit=Submit


Secunia has rated the vulnerability as “less critical.” The vendor, WWWSearchSolutions, will have to update the source code to fix the issue; developers using the script should check the website for a corrected version.

David Utter is a staff writer for WebProNews covering technology and business. Email him here.

RELATED ARTICLES:

Native Advertising Trend Has Some (Including Google) Concerned

Native Advertising Trend Has Some (Including Google) Concerned

Native advertising spend is on the rise, and is expected to reach $4. 57 billion in 2017. For comparison, last year it was at $1. 63 billion, and is projected to hit $2. 36 billion this year. Wh...
Googlers Talk Indoor Maps For 40 Minutes [Video]

Googlers Talk Indoor Maps For 40 Minutes [Video]

Google is doing a lot of interesting things with maps these days. Not only do they have a whole new Google Maps experience, but they continue to amaze us on a regular basis with some of their imagery...
Google Shows You How To Use Its Knowledge Graph Data In Your Own Apps

Google Shows You How To Use Its Knowledge Graph Data In Your Own Apps

In one of many interesting Google I/O sessions, Google shows developers how to tap into Freebase, the open core of its Knowledge Graph, to enhance their own apps with Knowledge Graph data. The se...
Top Rated White Papers and Resources

What do you think? Respond.

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

WebProNews Videos | Advertise | About Us | Newsletter | Archive | News Feeds | Terms & Conditions | Contact Us

WebProNews is an iEntry Network ® publication - © 1998-2013 All Rights Reserved.