SiteBar contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the translator.php script not properly sanitizing user-supplied input to the edit parameter. This may allow an attacker to include arbitrary PHP commands that will be executed.

The SiteBar application translation module can be forced into code execution can occur in one of two ways. Firstly, it makes no sanity checks on the value passed within the edit parameter prior to using the value as part of an eval() call, for example:

http://192.168.1.1/translator.php?lang=zh_CN&cmd=upd&edit=$GET[%22lang%22];system(%22uname%20-a%22);

Upgrade to version 3.3.9 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.

• CVE ID: 2007-5693 (see also: NVD)
• Bugtraq ID: 26126
• Secunia Advisory ID: 27503 28008
• Related OSVDB ID: 41110 41355 41356 41357 41358 41359 41581 43604 43760
• VUPEN Advisory: ADV-2007-3768
• Vendor URL: http://archives.neohapsis.com/archives/bugtraq/2007-10/0294.html
  http://www.sitebar.org/
• Other Advisory URL: http://securityreason.com/securityalert/3318
  http://www.debian.org/security/2007/dsa-1423
  http://www.nth-dimension.org.uk/pub/NDSA20071016.txt.asc
• Vendor Specific News/Changelog Entry: http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup
• Vendor Specific Solution URL: http://www.gentoo.org/security/en/glsa/glsa-200711-05.xml
• Keyword: NDSA20071016

• Tim Brown - Nth Dimension