Directory traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to chmod arbitrary files to 0777 via ".." sequences in the lang parameter.

Several remote vulnerabilities have been discovered in sitebar, a web-based bookmark manager written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5491     A directory traversal vulnerability in the translation     module allows remote authenticated users to chmod     arbitrary files to 0777 via '..' sequences in the 'lang'     parameter.

  - CVE-2007-5492     A static code injection vulnerability in the translation     module allows a remote authenticated user to execute     arbitrary PHP code via the 'value' parameter.

  - CVE-2007-5693     An eval injection vulnerability in the translation     module allows remote authenticated users to execute     arbitrary PHP code via the'edit' parameter in an 'upd     cmd' action.

  - CVE-2007-5694     A path traversal vulnerability in the translation module     allows remote authenticated users to read arbitrary     files via an absolute path in the 'dir' parameter.

  - CVE-2007-5695     An error in command.php allows remote attackers to     redirect users to arbitrary websites via the 'forward'     parameter in a 'Log In' action.

  - CVE-2007-5692     Multiple cross site scripting flaws allow remote     attackers to inject arbitrary script or HTML fragments     into several scripts.

The remote host is affected by the vulnerability described in GLSA-200711-05 (SiteBar: Multiple issues)

    Tim Brown discovered these multiple issues: the translation module does     not properly sanitize the value to the 'dir' parameter (CVE-2007-5491,     CVE-2007-5694); the translation module also does not sanitize the     values of the 'edit' and 'value' parameters which it passes to eval()     and include() (CVE-2007-5492, CVE-2007-5693); the log-in command does     not validate the URL to redirect users to after logging in     (CVE-2007-5695); SiteBar also contains several cross-site scripting     vulnerabilities (CVE-2007-5692).
  Impact :

    An authenticated attacker in the 'Translators' or 'Admins' group could     execute arbitrary code, read arbitrary files and possibly change their     permissions with the privileges of the user running the web server by     passing a specially crafted parameter string to the 'translator.php'     file. An unauthenticated attacker could entice a user to browse a     specially crafted URL, allowing for the execution of script code in the     context of the user's browser, for the theft of browser credentials or     for a redirection to an arbitrary website after login.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
29258	Debian DSA-1423-1 : sitebar - several vulnerabilities	Nessus	Debian Local Security Checks	high
27816	GLSA-200711-05 : SiteBar: Multiple issues	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-5491

high

Tenable Plugins

high

high