CVE-2007-1236

CVE-2007-1236 affects sitex applications and concerns information disclosure through error messages produced by calendar.php (parameters sxMonth[] or sxYear[]) and calendar_events.php (parameter page[]). An attacker can craft requests with numerical values that cause error responses revealing the...

CVE-2007-1237

CVE-2007-1237 concerns a vulnerability in sitex where remote attackers can disclose potentially sensitive information by supplying a crafted quote character value for certain parameters, which triggers a SQL error. Multiple sources corroborate this description (NVD/NIST, CVE listings, and related...

CVE-2007-1234: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via 1 the sxYear parameter to calendar.php, 2 the search parameter to search.php, 3 the linkid parameter to redirect.php, or 4 the page parameter to calendarevents.php...

CVE-2007-1237: Exposure of Sensitive Information to an Unauthorized Actor

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1236: Undefined Security Weakness

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1235: Improper Input Validation

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

sitex multiple vulnerabilities

global risk:critical upload vulnerability: in user profile upload an avatar with a double extension like : file.php.jpg once it's done,you gone get an error like:Fatal error: Call to undefined function imagedestroy in /. but the last extension jpg will be removed by the script, and stored in :...

SiteX07.txt

I MurderSkillz from g00ns.net have found xss and possible SQL injection vulnerabilities in SiteX 0.7 and possibly other versions. Shouts to z3r0, neX, uid0 exploitercode.com, Zodiac, Wicked, and all the other I may have forgot.. Once again..g00ns.net fucking owns j00! SQL injection albums.php...