Description
Cross-site scripting (XSS) vulnerability in command.php in SiteBar 3.3.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the command parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | sitebar | 3.2.6-7.1 | DSA-1130-1 |
Advisories 1
- DSA-1130-1 sitebar - missing input validation Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2006-2568 vdb-entry
- 20071018 Serious holes affecting SiteBar 3.3.8 mailing-list
- 1174 third-party-advisory
- sitebar-command-xss(27421) vdb-entry
- DSA-1130 vendor-advisory
- http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup
- 20060627 [Kurdish Security # 11] SiteBar Cross-Site Scripting mailing-list
- 26126 vdb-entry
- http://kurdishsecurity.blogspot.com/2006/06/kurdish-security-11-sitebar-cross-site.html
- 18680 vdb-entry
- 21248 third-party-advisory
- 26869 vdb-entry
- 20841 third-party-advisory