Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Sitex lets remote attackers retrieve data via crafted input

CVE-2007-1237 · published 19 years ago
Summary

The Sitex web application can be tricked into revealing sensitive information when an attacker sends specially crafted requests containing a single‑quote character. This causes database errors that may expose data such as user details or other private content. Apply the vendor’s security patch or ensure all input is properly validated and escaped to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
bj_sintay sitex 0.7.3
cpe:2.3:a:bj_sintay:sitex:0.7.3:*:*:*:*:*:*:*
Original advisory text
sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL er...
sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by parameters used in forum and search, which forces a SQL error.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published3 Mar 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-1237 · NVD
Track software like this
Free during beta