Siteframe 3: Cross-Site Scripting (XSS) Vulnerability
Siteframe has, unfortunately, been shown to be vulnerable to cross-site scripting attacks. In this case, an attacker from a remote site can use a security hole in Siteframe to access files on the attacked computer.
There is a fix; you need to edit the file web/siteframe.php and change this line (which appears near line 20 at the top of the file):
if ($LOCAL_PATH == "")
to this
if ($LOCAL_PATH != "../")
You also need to add the following lines to web/classes.php immediately following the $PAGE_START= line:
// security fix
if ($LOCAL_PATH != "../")
$LOCAL_PATH = "./";
This will ensure that $LOCAL_PATH only contains a valid value.
Siteframe 3.2.2 contains both these fixes.
