CVE-2007-5141

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

waraxe-2007-SA057.txt

waraxe-2007-SA057 - Unauthorized File Upload in SiteX CMS ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-57.html Target software description:...

CVE-2007-5141: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.php in SiteX CMS 0.7.3 Beta allows remote attackers to execute arbitrary SQL commands via the search parameter...

[waraxe-2007-SA#055] - Sql Injection in SiteX CMS 0.7.3 Beta

waraxe-2007-SA055 - Sql Injection in SiteX CMS 0.7.3 Beta ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-55.html Target software description:...

[waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS

waraxe-2007-SA057 - Unauthorized File Upload in SiteX CMS ==================================================================== Author: Janek Vind "waraxe" Date: 27. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-57.html Target software description:...

Sql injection

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1237

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1236

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1235

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

CVE-2007-1235

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

CVE-2007-1236

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1237

CVE-2007-1237 concerns a vulnerability in sitex where remote attackers can disclose potentially sensitive information by supplying a crafted quote character value for certain parameters, which triggers a SQL error. Multiple sources corroborate this description (NVD/NIST, CVE listings, and related...

CVE-2007-1236

CVE-2007-1236 affects sitex applications and concerns information disclosure through error messages produced by calendar.php (parameters sxMonth[] or sxYear[]) and calendar_events.php (parameter page[]). An attacker can craft requests with numerical values that cause error responses revealing the...

CVE-2007-1235

CVE-2007-1235 describes an unrestricted file upload vulnerability in sitex. An attacker can upload arbitrary PHP code by crafting an avatar filename with a double extension (for example, .php.jpg). The system fails to verify the extension properly and saves the file as a .php, enabling remote cod...

CVE-2007-1237

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1236: Undefined Security Weakness

sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the 1 sxMonth or 2 sxYear parameter to calendar.php, or the 3 page parameter to calendarevents.php, which reveals the path in various error messages...

CVE-2007-1235: Improper Input Validation

Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg, which fails verification and is saved as a .php file...

CVE-2007-1237: Exposure of Sensitive Information to an Unauthorized Actor

sitex allows remote attackers to obtain potentially sensitive information via a ' quote value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error...

CVE-2007-1234: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via 1 the sxYear parameter to calendar.php, 2 the search parameter to search.php, 3 the linkid parameter to redirect.php, or 4 the page parameter to calendarevents.php...

sitex multiple vulnerabilities

global risk:critical upload vulnerability: in user profile upload an avatar with a double extension like : file.php.jpg once it's done,you gone get an error like:Fatal error: Call to undefined function imagedestroy in /. but the last extension jpg will be removed by the script, and stored in :...