SiteBar contains a flaw that allows a remote cross site redirection attack. This flaw exists because the application does not validate the forward parameter upon submission to the command.php script. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. This could be leveraged to direct a user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

SiteBar can be made to redirect users to malicious locations, as it makes no checks on the value passed within the forward parameter of the URL, for example:

http://192.168.1.1/command.php?command=Log%20In&forward=http://www.google.com/

Upgrade to version 3.3.9 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

• CVE ID: 2007-5695 (see also: NVD)
• Bugtraq ID: 26126
• Secunia Advisory ID: 27503 28008
• Related OSVDB ID: 41110 41355 41356 41357 41358 41359 41581 43604 43760
• VUPEN Advisory: ADV-2007-3768
• Other Advisory URL: http://securityreason.com/securityalert/3318
  http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup
  http://www.debian.org/security/2007/dsa-1423
  http://www.nth-dimension.org.uk/pub/NDSA20071016.txt.asc
• Vendor Specific Solution URL: http://www.gentoo.org/security/en/glsa/glsa-200711-05.xml
• Vendor URL: http://www.sitebar.org/
• Keyword: NDSA20071016

• Tim Brown - Nth Dimension