Multiple vulnerabilities in TCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Target CMS (TCMS), which could be exploited to perform cross-site scripting and SQL Injection attacks, read arbitrary files and compromise vulnerable system.

1) Cross-site scripting (XSS) vulnerabilities in TCMS
1.1 An input sanitation error was found in the "section" parameter in php/lib/admin.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is authorized and has access to administrative interface.
Exploitation example:
http://host/www/index.php?admin=1&section=language"><script>alert(document.c ookie)</script>&action=addLanguage
1.2 An input sanitation error was found in the "note" parameter in php/lib/admin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is authorized and has access to administrative interface.
Exploitation example:
<form action="http://host/www/index.php" method="post" name="main" >
<input type="hidden" name="template" value="3" />
<input type="hidden" name="language" value="1" />
<input type="hidden" name="name" value="home" />
<input type="hidden" name="note" value='The note text"><script>alert(document.cookie)</script>' />
<input type="hidden" name="value" value="page content" />
<input type="hidden" name="admin" value="1" />
<input type="hidden" name="text" value="1" />
<input type="hidden" name="section" value="content" />
<input type="hidden" name="id" value="9" />
<input type="hidden" name="action" value="Save text" />
</form>
<script>
document.main.submit();
</script>

2) Local file inclusion in TCMS
Input passed to the "template" parameter in www/index.php is not properly sanitized before being used to include local files. A remote attacker can include arbitrary files on the target system using directory traversal sequences with NULL byte.
Exploitation example:
http://host/www/index.php?template=./../../../../../../../tmp/test.php%00

3) SQL injection vulnerabilities in TCMS
3.1 The vulnerability exists due to input sanitation error in the " content " parameter in php/template/content.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/www/index.php?template=home&content=home'+ANY_SQL
3.2 An input validation error exists in the "index" parameter in php/template/forum.php. A remote attacker can create an account with specially crafted email address and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database.
Exploitation example:
http://host/www/index.php?template=forum&action=showReplies&index=1'+ANY_SQL _CODE
3.3 The vulnerability exists due to input sanitation error in the "id" parameter in php/template/blog.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://host/www/index.php?template=blog&id=1'+ANY_SQL_CODE