SiteBar: Multiple issues

Background SiteBar is a PHP application that allows users to store their bookmarks on a web server. Description Tim Brown discovered these multiple issues: the translation module does not properly sanitize the value to the "dir" parameter CVE-2007-5491, CVE-2007-5694; the translation module also...

Serious holes affecting SiteBar 3.3.8

All, As a result of a short security audit of SiteBar, a number of security holes were found. The holes included code execution, a malicious redirect and multiple cases of Javascript injection. After liasing with the developers, the holes have been patched. Attached are the advisory and patch...

CVE-2007-5491

Summary of CVE-2007-5491 family in SiteBar : The translation module (translator.php) in SiteBar 3.3.8 is vulnerable to a directory traversal attack via the lang parameter (using .. sequences), allowing remote authenticated users to chmod arbitrary files to 0777. Related entries (CVE-2007-5492, CV...

CVE-2006-5491

The CVE-2006-5491 entry describes multiple SQL injection vulnerabilities in include/index.php of UltraCMS 0.9, permitting remote attackers to execute arbitrary SQL commands via the username or password parameters. This indicates inadequate input handling in the affected PHP code path. The connect...