Multiple Vulnerabilities in eoCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in eoCMS which could be exploited to perform script insertion and SQL injection attacks, gain access to sensitive information and compromise vulnerable system.

1) Script insertion vulnerability in eoCMS
An input sanitation error exists in the way application handles color BBCode tag. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when the user views the malicious data.
Exploitation example:
[img][color=onerror=javascript:alert(document.cookie);"][/color][/img]

2) SQL injection vulnerability in eoCMS
The vulnerability exists due to input sanitation error in the "eocms" cookie in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
GET /index.php HTTP/1.0
Cookie: eocms='SQL_CODE_HERE

3) Local file inclusion vulnerability in eoCMS
Input passed to the "lang" and "theme" parameters via index.php is not properly sanitized before being used to include local files. A remote attacker can include arbitrary files on the target system using directory traversal sequences with NULL byte.
Exploitation examples:
http://[host]/index.php?lang=file
http://[host]/index.php?theme=../../../.. /../../../../../../../../../../../etc/passwd%00